PT-2021-7971 · Node.Js · Node-Red

Name of the Vulnerable Software and Affected Versions: Node-RED versions 1.2.7 and earlier Description: The issue concerns a Prototype Pollution vulnerability in the admin API of Node-RED, a low-code programming tool for event-driven applications built using nodejs. A badly formed request can...

PT-2021-17043 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue concerns the cleartext transmission of sensitive information in the synorelayd component of Synology DiskStation Manager DSM. This allows man-in-the-middl...

PT-2021-17354

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001 Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The flaw exists within the processi...

PT-2021-15253 · Ubiquiti · Unifi Protect

Name of the Vulnerable Software and Affected Versions: UniFi Protect versions prior to 1.17.1 Description: The issue allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash. Recommendations: For versions prior to 1.17.1,...

PT-2021-1525 · Google +1 · Android Kernel +1

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a use after free in the io uring subsystem of the Linux kernel, which could lead to local escalation of privilege with System execution privileges needed. User interaction is not required fo...

PT-2021-11555

Name of the Vulnerable Software and Affected Versions: merge versions prior to 2.1.1 Description: The issue concerns Prototype Pollution via the recursiveMerge function. This affects the merge package, potentially allowing for malicious modifications to the prototype. Recommendations: For version...

PT-2021-11797 · Helmholz +1 · Myrex24.Virtual +2

Name of the Vulnerable Software and Affected Versions: MB connect line mymbCONNECT24 versions through 2.11.2 mbCONNECT24 versions through 2.6.2 Helmholz myREX24 versions through 2.11.2 Helmholz myREX24.virtual versions through 2.11.2 Description: An issue was discovered that allows an attacker to...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

PT-2021-5544 · Openldap +6 · Openldap +6

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha Description: The issue is related to an assertion failure in the issuerAndThisUpdateCheck function, which can occur via a crafted packet with a short timestamp, resulting in a denial of...

PT-2021-3193

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.9.3 through 0.13.0 Description The issue is related to an uncontrolled resource consumption in the Apache Thrift library of the Avrora Center application. It can be exploited by a remote attacker to cause a denial of...

PT-2021-14409

Name of the Vulnerable Software and Affected Versions: Adminer versions 4.0.0 through 4.7.9 Description: Adminer is an open-source database management in a single PHP file. There is a server-side request forgery vulnerability in Adminer versions bundling all drivers, such as adminer.php. This iss...

PT-2021-15585 · Mcafee · Mcafee Endpoint Security (Ens) For Windows

Name of the Vulnerable Software and Affected Versions: McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 February 2021 Update Description: A Null Pointer Dereference issue allows a local administrator to cause Windows to crash via a specific system call which is not handled...

PT-2021-2951 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier Description: The issue is related to a lack of protection for SQL query structures in the Magento Commerce platform, which can be...

PT-2021-4992 · Mcafee · Mcafee Total Protection

Name of the Vulnerable Software and Affected Versions: McAfee Total Protection versions prior to 16.0.30 Description: The issue is related to improper privilege management, allowing a local user to gain elevated privileges and execute arbitrary code, bypassing self-defense mechanisms. This can be...

PT-2021-9427 · Svakom · Svakom Siime Eye

Name of the Vulnerable Software and Affected Versions: Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14 Description: A command injection issue resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters,...

PT-2021-2030 · Xopen · Xopen

Name of the Vulnerable Software and Affected Versions: xopen versions all Description: The issue is related to a command injection vulnerability in the xopenfilepath function. This vulnerability exists due to the lack of neutralization of special elements used in the operating system command...

PT-2021-8103 · Htmldoc +4 · Htmldoc +4

Name of the Vulnerable Software and Affected Versions: htmldoc versions 1.9.12 and earlier Description: A security issue is found in the image load jpeg function of the image.cxx component, related to NULL pointer dereference errors. This issue may allow an attacker to access confidential data,...

PT-2021-5555 · Openldap +7 · Openldap +7

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions prior to 2.4.57 Description: The issue is related to an insufficient use of the assert function in the open implementation of the OpenLDAP protocol. It may allow a remote attacker to execute a denial of service attack by...

PT-2021-19562 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList version 3.6.0 Description: The issue allows for CSV injection, related to the email parameter, and affects the /lists/admin/ endpoint. Recommendations: For phpList version 3.6.0, consider restricting access to the /lists/admin/ endpoi...

Huawei Emui and Honor Magic Ui buffer overflow vulnerability (CNVD-2022-52826)

Huawei Emui is an Android-based mobile operating system from Huawei, China.Honor Magic Ui is an Android-based mobile operating system from Honor, China. A buffer overflow vulnerability exists in Huawei Emui and Honor Magic Ui, which can be exploited by an attacker who can exploit the vulnerabilit...