PT-2021-4253

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to the fixed version Description The overlayfs implementation in the Linux kernel did not properly validate the setting of file capabilities on files in an underlying file system with respect to user namespaces. Thi...

PT-2021-18117 · Forgerock · Forgerock Openam

Name of the Vulnerable Software and Affected Versions: ForgeRock OpenAM versions prior to 13.5.1 Description: The issue allows LDAP injection via the Webfinger protocol. An unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a...

PT-2021-17375 · Foxit · Foxit Phantompdf

Name of the Vulnerable Software and Affected Versions: Foxit PhantomPDF version 10.1.0.37527 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2021-14373 · Octobercms · October

Name of the Vulnerable Software and Affected Versions: October versions prior to 1.1.2 Description: The issue exists in October when running on poorly configured servers, where the server routes any request, regardless of the HOST header, to an October CMS instance. This allows for Host Header...

PT-2021-11086

Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A PHP object injection bug in profile.php unserializes the untrusted data of the strProfileData POST-variable, allowing an unauthenticated attacker to execute code via a crafted POST request...

PT-2021-15249 · Nextcloud +1 · Nextcloud +1

Name of the Vulnerable Software and Affected Versions: Nextcloud versions prior to 20.0.6 Description: A missing user check in Nextcloud inadvertently populates a user's own credentials for other users' external storage configuration when not already configured yet. Recommendations: For Nextcloud...

PT-2021-15234 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 2.4.21 through 2.20.23 GitHub Enterprise Server versions 2.21.0 through 2.21.14 GitHub Enterprise Server versions 2.22.0 through 2.22.6 GitHub Enterprise Server versions 3.0.0 Description: An improper access...

PT-2021-9432 · Apache +5 · Apache Batik +5

Name of the Vulnerable Software and Affected Versions: Apache Batik version 1.13 Description: The issue is caused by improper input validation by the NodePickerPanel, allowing an attacker to exploit the vulnerability and cause the underlying server to make arbitrary GET requests. This can be...

PT-2021-9721 · Red Hat +1 · Keycloak Gatekeeper +1

Name of the Vulnerable Software and Affected Versions: Keycloak Gatekeeper versions all Description: A vulnerability was found in Keycloak Gatekeeper where an attacker can bypass the Gatekeeper by using lower case HTTP headers, for example, via cURL. This issue is particularly problematic when th...

PT-2021-2348 · Advantech · Advantech Webaccess/Scada

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess/SCADA version 9.0.1 Description: A local privilege elevation issue exists in the file system permissions of the installation, specifically in the webvrpcs Run Key Privilege Escalation. This allows an attacker to replace...

PT-2021-2884

Name of the Vulnerable Software and Affected Versions SonicWall SSLVPN SMA100 versions 10.x Description The issue is related to a SQL Injection vulnerability in the SonicWall SSLVPN SMA100 product. This vulnerability allows a remote unauthenticated attacker to perform SQL queries to access...

Exploit for CVE-2021-2109

CVE-2021-2109: WebLogic Server Remote Code Execution Vulnerabili...

PT-2021-1872 · Cisco · Cisco Dna Center

Name of the Vulnerable Software and Affected Versions: Cisco DNA Center Software affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack, manipulating an...

PT-2021-11378 · Philips · Philips Interventional Workspot +1

Name of the Vulnerable Software and Affected Versions: Philips Interventional Workspot versions 1.3.2 through 1.4.5 Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live version 1.0 ViewForum version 6.3V1L10 Description: The software constructs all or part of an OS command using externally...

PT-2021-9623 · Unknown · Mobile-911 Server

Name of the Vulnerable Software and Affected Versions: Mobile-911 Server version V2.5 Description: A local privilege elevation issue exists in the file system permissions of the Mobile-911 Server install directory. This allows an attacker to overwrite the service executable, execute arbitrary cod...

PT-2021-9621 · Unknown · Win-911 Enterprise

Name of the Vulnerable Software and Affected Versions: Win-911 Enterprise version 4.20.13 Description: A local privilege elevation issue exists due to file system permissions in the install directory via the "WIN-911 Mobile Runtime" service. An attacker can overwrite executables, potentially...

PT-2020-17385 · Bigprof · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System versions prior to 3.0 Description: The issue concerns a lack of CSRF protection in the "admin/pageTransferOwnership.php" endpoint, allowing an attacker to escalate privileges to Administrator and take over the...

Acronis: Stored XSS in Acronis Cyber Protect Console

Dear Acronis Security Team, Summary There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce add details for how we can reproduce the issue 1. Login to the console with the given account 2. Go to "Protection" under "PLANS" 3. Click on "Crea...

PT-2020-13595 · Nzxt · Nzxt Cam

Name of the Vulnerable Software and Affected Versions: NZXT CAM version 4.8.0 Description: An information disclosure issue exists in the WinRing0x64 Driver IRP 0x9c402084 functionality. A specially crafted I/O request packet IRP can cause the disclosure of sensitive information. An attacker can...

PT-2020-19793 · I18N · I18N

Name of the Vulnerable Software and Affected Versions: i18n versions prior to 2.1.15 Description: The issue arises from insufficient handling of erroneous language tags in the files src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. This results in a vulnerability that affec...