4819 matches found
[SECURITY] Fedora 32 Update: eclipse-webtools-3.18.0-4.fc32
Eclipse Webtools. This contains sub-packages for different sub-projects of Eclipse Webtools project, including Server Tools, SourceEditing Tools, Webservices Tools, Java EE Tools, JSF Tools, and Dali JPA Tools...
Improper access control
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...
CVE-2020-15525
CVE-2020-15525 affects GitLab EE versions 11.3–13.1.2 and is caused by Incorrect Access Control at the Maven package upload endpoint. The issue enables unauthorized access via Maven Repository APIs (impact described as partial confidentiality in CVSS terms); some sources note potential access to ...
CVE-2020-15525
Removed by vendor...
CVE-2020-15525: Undefined Security Weakness
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...
CVE-2020-13264
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...
CVE-2020-13264
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...
CVE-2020-13263
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...
Code injection
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...
CVE-2020-13261
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...
CVE-2020-13263
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
Code injection
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...
Authorization
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
Design/Logic Flaw
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
CVE-2020-13262
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...
CVE-2020-13264
GitLab CE/EE versions 10.3–13.0.1 are affected by CVE-2020-13264, which allows other group maintainers to view Kubernetes cluster tokens due to token disclosure. The issue affects GitLab’s Kubernetes integration/token handling (no details on exploit vector beyond token exposure). Fixes are availa...