CVE-2021-22799

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1...

PT-2022-14821 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.329 and earlier Jenkins LTS versions 2.319.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to trigger a build of a job without parameters when no security realm is set. This issue...

PT-2022-15016 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.8.3 WordPress versions prior to 3.7.37 Description: Low-privileged authenticated users, such as authors, in the WordPress core are able to execute JavaScript and perform a stored XSS attack, which can affect...

GHSA-XXFH-X98P-J8FR Remote code injection in Log4j (through pax-logging-log4j2)

Impact Remote Code Execution. Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11. Workarounds Set system property -Dlog4j2.formatMsgNoLookups=true References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q...

PT-2021-16216

Name of the Vulnerable Software and Affected Versions Video Lessons Manager WordPress plugin versions prior to 1.7.2 Video Lessons Manager Pro WordPress plugin versions prior to 3.5.9 Description The issue concerns the improper sanitization and escaping of values when updating settings, potential...

PT-2021-22391 · Atlassian · Jira +1

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.5.10 Atlassian Jira Server and Data Center versions 8.6.0 through 8.13.1 Description: The issue allows anonymous remote attackers to access the query component JQL endpoint via a Broke...

PT-2021-22065 · Brizy +1 · Brizy +1

Name of the Vulnerable Software and Affected Versions: Brizy Page Builder plugin versions 2.3.11 and earlier Brizy versions 1.0.127 and earlier, excluding version 1.0.126 Description: The Brizy Page Builder plugin for WordPress used an incorrect authorization check, allowing any logged-in user...

PT-2021-23325 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.14.1 RUGGEDCOM ROX RX1400 versions prior to V2.14.1 RUGGEDCOM ROX RX1500 versions prior to V2.14.1 RUGGEDCOM ROX RX1501 versions prior to V2.14.1 RUGGEDCOM ROX RX1510 versions prior to V2.14.1 RUGGEDC...

PT-2021-7741 · Redis +3 · Redis +3

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 5.0.14 Redis versions prior to 6.0.16 Redis versions prior to 6.2.6 Description: The issue is related to an integer overflow vulnerability in the hiredis library used by Redis, which can occur when parsing specially...

PT-2021-19926 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.18.4 Envoy versions prior to 1.19.1 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions, Envoy transitions a H/2 connecti...

PT-2021-21823 · Unknown · Phpfastcache

Name of the Vulnerable Software and Affected Versions: PhpFastCache versions prior to 6.1.5 PhpFastCache versions prior to 7.1.2 PhpFastCache versions prior to 8.0.7 Description: The issue concerns the exposure of phpinfo when the /vendor directory is not protected from public access. This...

PT-2021-19886 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 19.0.13 Nextcloud Server versions prior to 20.0.11 Nextcloud Server versions prior to 21.0.3 Description: The issue concerns default share permissions not being respected for federated reshares of files and...

PT-2021-7637 · Arm +2 · Mbed Tls +2

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 3.0.0 Mbed TLS versions prior to 2.27.0 Mbed TLS versions prior to 2.16.11 Description: The issue is related to the use of a broken or risky cryptographic algorithm in the mbedtls mpi exp mod function in lignum.c in...

PT-2021-3430 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.2 and earlier Magento versions 2.4.1-p1 and earlier Magento versions 2.3.6-p1 and earlier Description: The issue is related to an Improper Authorization vulnerability in the customers module. Successful exploitation could...

PT-2021-16944 · Atlassian · Connect Spring Boot

Name of the Vulnerable Software and Affected Versions: Atlassian Connect Spring Boot versions 1.1.0 through 2.1.3 Atlassian Connect Spring Boot versions 2.1.4 through 2.1.5 Description: The issue concerns Atlassian Connect Spring Boot, a Java Spring Boot package for building Atlassian Connect app...

PT-2021-3585 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 8.5.64 Apache Tomcat versions 9.0.44 Apache Tomcat versions 10.0.3 through 10.0.4 Description: A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. The issue is related to an erro...

PT-2021-2244 · Helmholz +1 · Myrex24.Virtual +2

Name of the Vulnerable Software and Affected Versions: MB connect line mymbCONNECT24 versions through v2.11.2 mbCONNECT24 versions through v2.11.2 Helmholz myREX24 versions through v2.11.2 Helmholz myREX24.virtual versions through v2.11.2 Description: The issue is related to improper access...

PT-2020-6718 · Samba +9 · Samba +9

Name of the Vulnerable Software and Affected Versions: Samba versions prior to 4.11.15 Samba versions prior to 4.12.9 Samba versions prior to 4.13.1 Description: A null pointer dereference flaw was found in Samba's Winbind service. This issue allows an attacker to cause a denial of service. A loc...

GHSA-C84H-W6CR-5V8Q Markdown-supplied Shell Command Execution

Impact lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "fileloader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. Patches Users should upgrade to lookatme versions 2.3.0 or...

PT-2020-15872 · Gnupg +1 · Gnupg Kleopatra +1

Name of the Vulnerable Software and Affected Versions: GnuPG Kleopatra versions prior to 3.1.12 GnuPG Kleopatra versions prior to 20.07.80 Description: The issue allows remote attackers to execute arbitrary code due to the unsafe handling of command-line options when supporting openpgp4fpr: URLs...