PT-2022-15071 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description: The implementation of shape inference for ConcatV2 can be used to trigger a deni...

PT-2022-9457 · WordPress · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: Error Log Viewer WordPress plugin versions prior to 1.1.2 Description: The issue concerns a lack of nonce check when deleting a log file and the absence of path traversal prevention. This could allow attackers to make a logged-in admin delete...

PT-2022-15038 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: gh-ost versions prior to 1.1.3 Description: The issue is related to an arbitrary file read vulnerability. It requires the attacker to have access to the target host or trick an administrator into executing a malicious gh-ost command, along wi...

CVE-2022-21721 DOS Vulnerability in next.js

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-...

PT-2022-1761 · Expat +12 · Expat +12

Name of the Vulnerable Software and Affected Versions: Expat aka libexpat versions prior to 2.4.3 Description: The issue is related to an integer overflow in the nextScaffoldPart function in xmlparse.c of the Expat library. This could allow a remote attacker to execute arbitrary code...

PT-2022-15643 · Partkeepr · Partkeepr

Name of the Vulnerable Software and Affected Versions: PartKeepr versions up to v1.4.0 Description: The issue allows an authenticated user to carry out SSRF Server-Side Request Forgery attacks and port enumeration due to a lack of validation in the functionality to upload attachments using a URL...

PT-2021-8081 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.19.223 Linux kernel versions prior to 5.4.169 Linux kernel versions prior to 5.10.89 Linux kernel versions prior to 5.15 Linux kernel versions prior to 5.15.12 Description: The issue is related to the i2c...

SUSE-SU-2021:4202-1 Security update for mariadb

This update for mariadb fixes the following issues: Update to 10.2.41: - CVE-2021-35604: Fixed InnoDB vulnerability that allowed an high privileged attacker with network access via multiple protocols to compromise MySQL bsc1192497...

Security update for log4j (important)

openSUSE Security Update: Security update for log4j Announcement ID: openSUSE-SU-2021:1601-1 Rating: important References: 1193743 Cross-References: CVE-2021-44228 CVE-2021-45046 CVSS scores: CVE-2021-44228 NVD : 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVE-2021-44228 SUSE: 9.8...

PT-2021-6077

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 3.0.1 Description The issue is related to a double free error in certain out-of-memory conditions, as demonstrated by a failure of the mbedtls ssl set session function. This error can potentially allow a remote...

Security Bulletin: IBM MQ is vulnerable to multiple issues with libcurl (CVE-2021-22946, CVE-2021-22947)

Summary Multiple issues were identified with a version of libcurl which is shipped with IBM MQ. libcurl is used by IBM MQ to provide CCDTURL functionality. Vulnerability Details CVEID: CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused b...

OPENSUSE-SU-2021:4109-1 Security update for logback

This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to...

Apache Log4j End of Life (EOL) Detection - Windows

The Apache Log4j version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2021-24198 · Mozilla +4 · Pdf.Js +4

Name of the Vulnerable Software and Affected Versions: GNOME Web aka Epiphany versions prior to 40.4 GNOME Web aka Epiphany versions 41.x prior to 41.1 Description: A security issue exists due to the use of a server's suggested filename as the pdf name value in PDF.js, leading to potential XSS...

PT-2021-24161 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1 Description: An issue allows replacing the content of any arbitrary page using action=mcrundo followed by action=mcrrestore...

PT-2021-23163 · Bookstack · Bookstack

Name of the Vulnerable Software and Affected Versions: BookStack versions prior to 21.11.3 Description: The issue allows a logged-in user with no privileges or a guest user if public access is enabled to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit...

PT-2021-23960 · Patrowl · Patrowl

Name of the Vulnerable Software and Affected Versions: PatrOwl versions prior to 1.77 Description: The issue is related to improper privilege management in PatrowlManager, allowing unlogged-in users to download all finding import files. The files are stored under /media/imports//, where owner id ...

PT-2021-5369

Name of the Vulnerable Software and Affected Versions Apache Log4j2 versions 2.15.0 Apache Log4j2 versions prior to 2.16.0 Java 8 Apache Log4j2 versions prior to 2.12.2 Java 7 Description The issue is related to the deserialization of untrusted data in the Apache Log4j2 library, which can be...

PT-2021-22771 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.0 through 14.3.6 GitLab CE/EE versions 14.4 through 14.4.4 GitLab CE/EE versions 14.5 through 14.5.2 Description: An issue has been discovered in GitLab CE/EE where the diff feature could be used to trigger high load...

OPENSUSE-SU-2021:1554-1 Security update for glib-networking

This update for glib-networking fixes the following issues: Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset bsc1172460. This update was imported from the SUSE:SLE-15-SP2:Update update project...