CISA’s VDP Platform 2022 Annual Report Showcases Success

Today, the Cybersecurity and Infrastructure Security Agency CISA released its inaugural Vulnerability Disclosure Policy VDP Platform 2022 Annual Report, highlighting the service’s progress supporting vulnerability awareness and remediation across the Federal Civilian Executive Branch FCEB. This...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS when the IW44EncodeCodec.cpp function is utilized, by instigating a division by zero scenario. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in IW44Image.cpp, by triggering a divide by zero error. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users. Unlike other...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. A reachable Object::getString assertion allows attackers to cause a denial of service due to a failure in markObject. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0 <=2.54.0), com.compuware.jenkins:compuware-scm-downloader (>=1.6 <=2.0.5) +105 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (>=4.0 <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =4.0, =2.33.0, =1.6, =1.8, =1.0.2, =1.0.0, =2.0.0, =0.4, =1.0, =7.5.7, =0.9.1, =1.0-alpha-1, =1.27.19, =1.27.25 and more Source cves: CVE-2023-40338 Source advisory: OSV:GHSA-36HQ-V2FC-RPQP...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

SUSE: Security Advisory (SUSE-SU-2023:3265-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:3266-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:3267-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:3230-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

x86/AMD: Speculative Return Stack Overflow

ISSUE DESCRIPTION Researchers from ETH Zurich have extended their prior research XSA-422, Branch Type Confusion, a.k.a Retbleed and have discovered INCEPTION, also know as RAS Return Address Stack Poisoning, and Speculative Return Stack Overflow. The RAS is updated when a CALL instruction is...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to insufficient validation of branch names when importing a project. An authenticated and authorized user can exploit this vulnerability to import a project with a malicious branch name that contains 40 hexadecimal...

Improper Access Control

gitlab is vulnerable to an Improper Access Control vulnerability. This vulnerability occurs due to a flaw in the way that GitLab handles protected branches. An attacker can exploit this vulnerability to push to protected branches that were restricted to deploy keys...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists due to the infinite loop when an authenticated user with specific rights access a MR having source and target branch pointing to each other, leading to crash the application...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. An attacker can inject and execute malicious javascript through the merge request with maliciously crafted branch name...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. A branch/tag name confusion allows an attacker to manipulate pages where the content of the default branch would be expected...

Code injection

An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE versions prior to 16.0.8, prio...

PT-2023-24628 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 16.0.8 GitLab versions 16.1 prior to 16.1.3 GitLab versions 16.2 prior to 16.2.2 Description: An issue has been discovered in GitLab where the main branch of a repository with a specially designed name allows an...

GitLab 0 < 16.0.8 / 16.1.0 < 16.1.3 / 16.2.0 < 16.2.2 (CVE-2023-3401)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a reposito...