CVE-2021-41127

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model tar.gz file which allows a malicious actor to craft a model.tar.gz file which can overwrite or replace bot...

PT-2021-4560 · Php +10 · Php +10

Name of the Vulnerable Software and Affected Versions: PHP versions 7.3.x through 7.3.31 PHP versions 7.4.x through 7.4.24 PHP versions 8.0.x through 8.0.11 Description: The issue is related to the PHP FPM SAPI component, where child worker processes can access and modify memory shared with the...

PT-2021-6151 · Tp Link · Tp-Link Tl-Wr940N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR940N version 3.20.1 Build 200316 Rel.34392n 5553 Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N routers. Authentication is required to exploit th...

PT-2021-23142 · Snudown · Snudown

Name of the Vulnerable Software and Affected Versions: Snudown versions prior to 1.7.0 Description: Snudown, a reddit-specific fork of the Sundown Markdown parser, is vulnerable to denial of service attacks due to its reference table implementation. The hash table used for references written in...

PT-2021-20965 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.28 Description: The issue allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in...

PT-2021-7915 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.28 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can be exploited to cause a denial of service. A low-privileged attacker wit...

PT-2021-7912 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.28 Description: The issue is related to a buffer overflow in the Core component of Oracle VM VirtualBox, which can be exploited by a high-privileged attacker with logon access to the infrastructure...

PT-2021-23639 · Unknown +1 · Bluemonday +1

Name of the Vulnerable Software and Affected Versions: bluemonday versions prior to 1.0.16 for Go bluemonday versions prior to 0.0.8 for Python in pybluemonday Description: The bluemonday sanitizer does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements,...

PT-2021-23275 · Unknown · Wallstreet Suite Trm

Name of the Vulnerable Software and Affected Versions: Wallstreet Suite TRM version 7.4.83 Description: A technical user has hardcoded credentials with higher privilege than the average authenticated user. The vendor disputes this claim, stating that the password is not hardcoded as it can be...

PT-2021-21267 · Yellowfin · Yellowfin

Name of the Vulnerable Software and Affected Versions: Yellowfin versions prior to 9.6.1 Description: The issue allows enumeration and download of uploaded images through an Insecure Direct Object Reference vulnerability. This can be exploited by sending a specially crafted HTTP GET request to th...

PT-2021-22065 · Brizy +1 · Brizy +1

Name of the Vulnerable Software and Affected Versions: Brizy Page Builder plugin versions 2.3.11 and earlier Brizy versions 1.0.127 and earlier, excluding version 1.0.126 Description: The Brizy Page Builder plugin for WordPress used an incorrect authorization check, allowing any logged-in user...

PT-2021-8121 · Draytek · Draytek Vigorconnect

Name of the Vulnerable Software and Affected Versions: Draytek VigorConnect version 1.6.0-B3 Description: A local file inclusion vulnerability exists in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary...

PT-2021-4388

Name of the Vulnerable Software and Affected Versions Windows Win32k versions prior to the fixed version Description The issue is related to a use-after-free vulnerability in the Win32k component of Windows operating systems. This vulnerability can be exploited to elevate privileges. The...

PT-2021-7668 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions Update 14 and earlier and Update 4 and earlier Description: The issue is caused by improper input validation, which could result in arbitrary file system read. Exploitation of this issue does not require user...

PT-2021-16165 · WordPress · Poll Maker

Name of the Vulnerable Software and Affected Versions: The Poll Maker WordPress plugin versions prior to 3.4.2 Description: The issue allows unauthenticated users to perform SQL injection via the ays finish poll AJAX action. Although the result is not disclosed in the response, it is possible to...

PT-2021-22557 · WordPress · Wp Bannerize

Name of the Vulnerable Software and Affected Versions: WP Bannerize WordPress plugin versions 2.0.0 through 4.0.2 Description: The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the /Classes/wpBannerizeAdmin.php file, which allows attacker...

PT-2021-7272 · Siemens · Simatic Step 7

Name of the Vulnerable Software and Affected Versions: SIMATIC STEP 7 TIA Portal V15 All versions SIMATIC STEP 7 TIA Portal V16 All versions V16 Update 5 SIMATIC STEP 7 TIA Portal V17 All versions V17 Update 2 Description: A vulnerability has been identified due to improper access control in the...

PT-2021-23485 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.36.3 Description: An issue was discovered in the GlobalWatchlist extension where the rev-deleted-user and ntimes messages were not properly escaped, allowing users to inject HTML and JavaScript. Recommendations:...

PT-2021-10651 · Muyucms · Muyucms

Name of the Vulnerable Software and Affected Versions: Myucms version 2.2.1 Description: The issue is related to a remote code execution RCE vulnerability in the controllerpoint.php component. This vulnerability can be exploited via the add method. Recommendations: For Myucms version 2.2.1,...

PT-2021-22716 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.9 and later Description: The issue concerns project exports in GitLab CE/EE, where trigger tokens configured on a project may be exposed. This affects all versions since 8.9. Recommendations: For GitLab CE/EE versions...