PT-2021-14686 · Jenkins · Jenkins Config File Provider Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Config File Provider Plugin versions 3.7.0 and earlier Description: The issue concerns incorrect permission checks in several HTTP endpoints, allowing attackers with global Job/Configure permission to enumerate system-scoped credentia...

PT-2021-11749 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.1.3 Description: A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installe...

PT-2021-2767 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can be exploited to cause a denial of service. This vulnerability allows a...

PT-2021-17501 · Unknown · Phpgurukul Beauty Parlour Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Beauty Parlour Management System version 1.0 Description: The issue allows remote attackers to obtain sensitive database information by injecting SQL commands into the sername parameter in the "add-services.php" component...

CVE-2021-27905

A flaw was found in solr. The ReplicationHandler in Apache Solr does not check proper parameters when connecting to another Solr instance to replicate index data into the local core leading to a SSRF vulnerability. The highest threat from this vulnerability is to data confidentiality and integrit...

PT-2021-7867 · Libraw +8 · Libraw +8

Name of the Vulnerable Software and Affected Versions: LibRaw version 0.20.0 Description: The issue is related to a buffer overflow in the LibRaw buffer datastream::gets function, located in the libraw datastream.cpp component of the LibRaw image processing library. This allows an attacker to...

PT-2021-8023 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc4-syzkaller Description: The vulnerability is related to a divide error in the nft limit init function, which is caused by the div u64 function dividing a 64-bit unsigned integer by a 32-bit unsigned...

PT-2021-9653 · Unknown · Rukovoditel Project Management App

Name of the Vulnerable Software and Affected Versions: Rukovoditel Project Management App version 2.7.2 Description: An exploitable SQL injection issue exists in the "forms fields rules/rules" page. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated...

PT-2021-9610 · Openiam · Openam

Name of the Vulnerable Software and Affected Versions: OpenIAM versions prior to 4.2.0.3 Description: The issue concerns a lack of permission verification for users attempting to perform administrative actions through the "/webconsole/rest/api/" endpoint. This means that users without proper...

PT-2021-3350 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.31.12 and earlier MediaWiki versions 1.32.x through 1.35.1 Description: An issue in MediaWiki has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been...

PT-2021-14908 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.6 and later Description: An issue exists where an infinite loop occurs when an authenticated user with specific rights accesses a merge request MR having source and target branches pointing to each other...

PT-2021-18384 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions 0.10.0 through 0.13.3 Description: The issue is related to an Open Redirect in the user sign-in/out process. Some API endpoints under /.pomerium/ do not verify parameters with pomerium signature, which could allow modifying...

PT-2021-14889 · Gitlab · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6.0 and above Description: A potential Denial of Service DoS issue was identified in gitlab-shell, allowing an attacker to increase server resource utilization via the gitlab-shell command. Recommendations: For GitLab...

PT-2021-15157 · Rockwell Automation · Micrologix 1400

Name of the Vulnerable Software and Affected Versions: Rockwell Automation MicroLogix 1400 versions 21.6 and below Description: The issue allows a remote unauthenticated attacker to send a specially crafted Modbus packet, enabling the retrieval or modification of random values in the register...

PT-2021-14891 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.2 Description: A vulnerability was discovered in GitLab that made it susceptible to a Server-Side Request Forgery SSRF attack. The attack was possible through the Outbound Requests feature. Recommendations: For...

PT-2021-13864 · Privoxy +4 · Privoxy +4

Name of the Vulnerable Software and Affected Versions: privoxy versions prior to 3.0.32 Description: A flaw was found in the software, allowing an assertion failure to be triggered with a crafted CGI request, leading to a server crash. This issue can be exploited by attackers to cause a denial of...

PT-2023-12115 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.1.2 Moodle version 3.10.1 Description: The issue is related to persistent/stored cross-site scripting XSS due to improper input sanitization on the Additional HTML Section via Header and Footer parameter in...

PT-2021-11745 · Unknown · Thinkadmin

Name of the Vulnerable Software and Affected Versions: ThinkAdmin version 6 Description: The issue concerns default administrator credentials in ThinkAdmin, allowing attackers to gain unrestricted access to the administrator dashboard. Recommendations: For ThinkAdmin version 6, change the default...

PT-2021-7746

Name of the Vulnerable Software and Affected Versions Veritas Backup Exec versions prior to 21.2 Description A flaw exists in Veritas Backup Exec related to weaknesses in the authentication process when using the SHA cryptographic algorithm. This allows a remote attacker to gain unauthorized acce...

CVE-2021-21297

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default...