PT-2021-15386 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.2.0 through 3.9.24 Description: An issue was discovered in the template manager due to missing input validation. Recommendations: For versions 3.2.0 through 3.9.24, update to a version that includes input validation in the...

PT-2021-15384 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 2.5.0 through 3.9.24 Description: An issue was discovered that could lead to xss issues due to missing filtering of messages shown to users. Recommendations: For Joomla! versions 2.5.0 through 3.9.24, update to a version that...

CVE-2021-23126

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand function within the process of generating the 2FA secret...

Joomla path traversal vulnerability

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A path traversal vulnerability exists in Joomla! 3.0.0 - 3.9.24. An attacker can...

object-collider

Vladyslav Tkachenko object-collider is an open source application by Vladyslav Tkachenko. Provides the ability to merge original old objects without source code modification, and optionally provide custom merge behavior for each specific sub-path A security vulnerability exists in object-collider...

Apache Tomcat information leakage vulnerability

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements support for Servlet and JavaServer Page JSP. An information disclosure vulnerability exists in Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to...

PT-2021-17412 · Grafana +6 · Grafana +6

Name of the Vulnerable Software and Affected Versions: Grafana versions 6.7.3 through 7.4.1 Description: The snapshot feature in Grafana can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set. This issue is related...

Cisco StarOS operating system resource management error vulnerabilities

Cisco StarOS is a router operating system that controls the entire system logic and can control processes and CLIs. A denial of service vulnerability exists in the SSH service for Cisco StarOS 21.9.0 - 21.19.10. The vulnerability stems from a logic error that can occur under certain traffic...

PT-2021-13942 · Ibm · Ibm Security Verify Information Queue

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Information Queue versions 1.0.6 through 1.0.7 Description: The issue discloses sensitive information in source code that could be used in further attacks against the system. Recommendations: For versions 1.0.6 and 1.0.7,...

CVE-2020-5023

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resource consumption. IBM X-Force ID: 193659...

CVE-2021-21306

Marked is an open-source markdown parser and compiler npm package "marked". In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is...

DEBIAN-CVE-2020-36148

Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions e.g. in embedded environment...

libmysofa code-related vulnerabilities

libmysofa is a lightweight C library for reading AES SOFA files. A null pointer dereference vulnerability exists in libmysofa 0.5 - 1.1. The vulnerability stems from the changeAttribute function failing to handle input data correctly. An attacker can exploit the vulnerability to cause segmentatio...

PT-2022-20313 · Lighttpd +1 · Lighttpd +1

Name of the Vulnerable Software and Affected Versions: Lighttpd versions 1.4.56 through 1.4.58 Description: The issue allows a remote attacker to cause a denial of service due to CPU consumption from stuck connections. This is because a typo in the connection read header more function in...

CVE-2021-25912

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

PT-2021-7854 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 5.6 through 5.11 Description: A time-of-check to time-of-use issue exists in the io uring subsystem's IORING OP CLOSE operation, allowing a local user to elevate their privileges to root. This issue is related to...

CVE-2021-3341

A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows an attacker to read any file on the host file system via an HTTP request...

CVE-2020-4682

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509...

IBM QRadar SIEM code-related vulnerabilities

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A server-side...

CVE-2020-35753

The job posting recommendation form in Persis Human Resource Management Portal Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20, when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter...