PT-2021-19972 · Zoho · Zoho Manageengine Opmanager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 12.5.329 Description: The issue allows unauthenticated remote code execution due to a general bypass in the deserialization class. This could potentially lead to exposure of sensitive data or...

Acronis: Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm

Summary The store admin page is accessible without authentication at below URL: http://www.grouplogic.com/ADMIN/store/index.cfm The store admin page provides functionalities such as the following: - Add Edit Items - Search Products - Search Results - Search Orders - Orders Search Results - Add Ne...

PT-2021-17539 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 731, 740, 750 Description: The issue allows an attacker to cause a Denial of Service, affecting the Availability of the SAP system by blocking all work processes. This is achieved by calling the SPI WAIT MILLIS...

PT-2021-16564 · Google · Android

Name of the Vulnerable Software and Affected Versions: Customization Service versions prior to 2.2.02.1 in Android O8.x Customization Service versions prior to 2.4.03.0 in Android P9.0 Customization Service versions prior to 2.7.02.1 in Android Q10.0 Customization Service versions prior to 2.9.01...

PT-2021-16554 · Unknown · Sticker Center

Name of the Vulnerable Software and Affected Versions: stickerCenter versions prior to SMR APR-2021 Release 1 Description: The issue is related to improper access control, allowing local attackers to read or write arbitrary files of system process via untrusted applications. Recommendations: For...

PT-2021-5266 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to errors in code generation management. It allows a remote attacker to execute arbitrary code. The vulnerability can be exploited by a remote attacke...

HackerOne: Enumerating HackerOne Pentests

Summary: An attacker can enumerate companies that performed pentests using the HackerOne platform. Steps To Reproduce: HackerOne pentests usually have an alias ending in -h1p. We will use the HTTP Request below to enumerate pentests update X-CSRF-Token, Cookie, and contextteamhandle. PATCH...

PT-2021-16545 · Samsung · Bixby Voice

Name of the Vulnerable Software and Affected Versions: Bixby Voice versions prior to 3.0.52.14 Description: The issue allows attackers to execute privileged actions by hijacking and modifying the intent when using PendingIntent with implicit intent in Bixby Voice. Recommendations: For versions...

PT-2021-5820 · Curl +5 · Curl +5

Name of the Vulnerable Software and Affected Versions: curl versions 7.63.0 through 7.75.0 Description: The issue is related to the incorrect handling of TLS 1.3 session tickets, which can allow a malicious HTTPS proxy to perform a man-in-the-middle MITM attack. When using an HTTPS proxy and TLS...

PT-2021-14428 · Synapse +1 · Synapse +1

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.27.0 Description: The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow a...

PT-2021-13744 · Jsdom · Jsdom

Name of the Vulnerable Software and Affected Versions: JSDom affected versions not specified Description: JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled. Recommendations: At the moment...

PT-2021-3370 · Microsoft · Paint 3D

Name of the Vulnerable Software and Affected Versions: Paint 3D affected versions not specified Description: The issue is related to a buffer overflow in memory when parsing GLB files, which can allow an attacker to execute arbitrary code using a specially crafted malicious file or link...

PT-2021-14383 · Unknown · Angular-Expressions

Name of the Vulnerable Software and Affected Versions: angular-expressions versions prior to 1.1.2 Description: The issue allows Remote Code Execution if expressions.compileuserControlledInput is called where userControlledInput is text that comes from user input. The security of the package coul...

PT-2021-9640 · Phpgacl · Phpgacl

Name of the Vulnerable Software and Affected Versions: phpGACL version 3.3.7 Description: The issue allows for SQL injection through a specially crafted HTTP request. In the file admin/edit group.php, when the POST parameter action is set to “Delete”, the POST parameter delete group can lead to a...

PT-2021-19554 · Tenda · Tenda Ac5 Ac1200

Name of the Vulnerable Software and Affected Versions: Tenda AC5 AC1200 version V15.03.06.47 multi Description: A Stored Cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter in the Wifi Settings, specifically in the...

PT-2021-11845 · Unknown · Persis Human Resource Management Portal

Name of the Vulnerable Software and Affected Versions: Persis Human Resource Management Portal versions 17.2.00 through 17.2.35 Persis Human Resource Management Portal versions 19.0.00 through 19.0.20 Description: The job posting recommendation form in the Persis Human Resource Management Portal...

PT-2020-16397 · Jupyter · Jupyter Server

Name of the Vulnerable Software and Affected Versions: Jupyter Server versions prior to 1.1.1 Description: The issue is an open redirect vulnerability that could cause the Jupyter server to redirect the browser to a different malicious website. All Jupyter servers running without a base url prefi...

PT-2021-4578

Name of the Vulnerable Software and Affected Versions QEMU version 5.1.0 Description The issue is related to the ide atapi cmd reply end function in the QEMU emulator, which allows out-of-bounds read access due to a lack of buffer index validation. This can potentially enable an attacker to acces...

PT-2020-5501 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.5.25 Description: The issue exists due to incorrect handling of Object Graph Navigation Language OGNL expressions in Apache Struts. This can allow a remote attacker to execute arbitrary code when forced...

PT-2020-16337 · Rlx +1 · Rlx-Linux +1

Name of the Vulnerable Software and Affected Versions: Askey AP5100W Dual SIG versions 1.01.097 and all prior versions Description: The issue allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH, due to a weak password used at th...