CVE-2018-17451

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery CSRF in the Slack integration for issuing slash commands...

CVE-2018-17453

The CVE affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The issue allows attackers to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception. This is tied to the underlying vulnerability in the speci...

CVE-2018-17449

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference...

CVE-2018-17450

GitLab CVE-2018-17450 affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. It enables Server-Side Request Forgery (SSRF) via the Kubernetes integration, which can disclose a Google Cloud Platform (GCP) service token. The fix is in GitLab...

CVE-2018-17537

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

CVE-2018-17883

Removed by vendor...

CVE-2018-17537

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

CVE-2018-17537

CVE-2018-17537 affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The issue is a stored cross-site scripting (XSS) in the blog-viewer during repository browsing when a package.json exists. Root cause is not elaborated beyond the st...

CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

CVE-2018-17449

The CVE-2018-17449 entry applies to GitLab Community and Enterprise Edition versions prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The vulnerability is an insecure direct object reference in the events API that could allow remote attackers to disclose sensitive information ...

CVE-2018-17451

CVE-2018-17451 affects GitLab Community and Enterprise Edition. It is a CSRF flaw in the Slack integration used for issuing slash commands, present in versions before 11.1.7 (11.1.x), 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The CVSSv3.1 base score is 8.8 (HIGH). Affected component: Slack ...

CVE-2018-17536

Removed by vendor...

CVE-2018-17451

Removed by vendor...

USN-6022-1 kamailio vulnerabilities

It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 ESM. CVE-2018-16657 It was discovered...

USN-6022-1: Kamailio vulnerabilities

It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 ESM. CVE-2018-16657 It was discovered...

Security Bulletin: IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system [CVE-2013-4521, CVE-2013-2165 and CVE-2018-14667]

Summary IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system CVE-2013-4521. IBM Security Verify Governance is vulnerable to remote attacks caused by an error related to the handling of deserialization CVE-2013-2165. IBM Security Verify Governance ...

Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.

Summary Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-23498 DESCRIPTION: Grafana could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when datasource query...

Siemens SCALANCE S Improper Neutralization of Input During Web Page Generation (CVE-2018-16555)

A vulnerability has been identified in SCALANCE S602 All versions V4.0.1.1, SCALANCE S612 All versions V4.0.1.1, SCALANCE S623 All versions V4.0.1.1, SCALANCE S627-2M All versions V4.0.1.1. The integrated web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked in...

NewStart CGSL CORE 5.05 / MAIN 5.05 : libgovirt Vulnerability (NS-SA-2023-0019)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libgovirt packages installed that are affected by a vulnerability: - Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause th...

Siemens SCALANCE W1750D Command Injection (CVE-2018-7082)

A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that woul...