CVE-2018-15472

CVE-2018-15472 affects GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using Rouge can block for long periods in Sidekiq jobs without any timeout, potentially causing performance issues/denial of service. Remediation: upgra...

CVE-2018-17455

CVE-2018-17455 affects GitLab Enterprise Edition listed in the initial description: versions before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The root cause is an insecure direct object reference in the Merge Request Approvals feature, allowing an attacker to disclose sensitive info...

CVE-2018-17454

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen...

CVE-2018-17449

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference...

CVE-2018-15472

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout...

CVE-2018-17451

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery CSRF in the Slack integration for issuing slash commands...

CVE-2018-17537

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

CVE-2018-17453

The CVE affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The issue allows attackers to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception. This is tied to the underlying vulnerability in the speci...

CVE-2018-17450

GitLab CVE-2018-17450 affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. It enables Server-Side Request Forgery (SSRF) via the Kubernetes integration, which can disclose a Google Cloud Platform (GCP) service token. The fix is in GitLab...

CVE-2018-17883

Removed by vendor...

CVE-2018-17883

An issue was discovered in Open Ticket Request System OTRS 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS...

CVE-2018-17451

CVE-2018-17451 affects GitLab Community and Enterprise Edition. It is a CSRF flaw in the Slack integration used for issuing slash commands, present in versions before 11.1.7 (11.1.x), 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The CVSSv3.1 base score is 8.8 (HIGH). Affected component: Slack ...

CVE-2018-17536

Removed by vendor...

CVE-2018-17451

Removed by vendor...

CVE-2018-17449

The CVE-2018-17449 entry applies to GitLab Community and Enterprise Edition versions prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The vulnerability is an insecure direct object reference in the events API that could allow remote attackers to disclose sensitive information ...

CVE-2018-17537

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

CVE-2018-17537

CVE-2018-17537 affects GitLab Community and Enterprise Edition prior to 11.1.7, 11.2.x prior to 11.2.4, and 11.3.x prior to 11.3.1. The issue is a stored cross-site scripting (XSS) in the blog-viewer during repository browsing when a package.json exists. Root cause is not elaborated beyond the st...

USN-6022-1 kamailio vulnerabilities

It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 ESM. CVE-2018-16657 It was discovered...

USN-6022-1: Kamailio vulnerabilities

It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 ESM. CVE-2018-16657 It was discovered...

Security Bulletin: IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system [CVE-2013-4521, CVE-2013-2165 and CVE-2018-14667]

Summary IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system CVE-2013-4521. IBM Security Verify Governance is vulnerable to remote attacks caused by an error related to the handling of deserialization CVE-2013-2165. IBM Security Verify Governance ...