4350 matches found
CVE-2021-22241
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...
CVE-2021-22241
Removed by vendor...
GitLab 跨站脚本漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab CE ...
The vulnerability of the PBX software for IP communications allows attackers to carry out cross-site scripting attacks.
The vulnerability of PBX software for IP communications is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
Gitlab -- Gitlab
Gitlab reports: Stored XSS in Mermaid when viewing Markdown files Stored XSS in default branch name Perform Git actions with an impersonation token even if impersonation is disabled Tag and branch name confusion allows Developer to access protected CI variables New subscriptions generate OAuth...
CVE-2021-37453
Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the extension name stored...
Oracle FLEXCUBE Universal Banking has an unspecified vulnerability (CNVD-2021-54692)
An unspecified vulnerability exists in the Flex-Branch component of Oracle FLEXCUBE Universal Banking, a real-time, online, comprehensive global core banking solution that covers retail, corporate, and investment banking. An attacker could exploit this vulnerability to compromise confidentiality...
CVE-2017-5715
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance optimization. There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant...
Oracle Financial Services Applications安全漏洞
An unspecified vulnerability exists in the Flex-Branch component of Oracle FLEXCUBE Universal Banking, a real-time, online, comprehensive global core banking solution that covers retail, corporate, and investment banking. An attacker could exploit this vulnerability to compromise confidentiality...
SUSE: Security Advisory (SUSE-SU-2021:2353-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP5 : kernel (EulerOS-SA-2021-2221)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...
SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2352-1)
The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2352-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: ...
SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2021:2321-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2321-1 advisory. The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixe...
The vulnerability of the virtualization paravirtualization mode implementation in Xen hypervisors allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the PV mode implementation in Xen hypervisors relates to the use of the Indirect Branch Restricted Speculation IBRS mechanism for indirect branch control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
GitLab: Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"
Summary A stored XXS exists in the main page of a project. By changing the "default branch name" of a group a malicious user can inject arbitrary JavaScript into the main page of a project. Any user that is either at least developer of the project, or an administrator of the GitLab instance, and...
PT-2021-6694 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 and later Description: The issue is related to a stored cross-site-scripting vulnerability in GitLab CE/EE, which can be exploited via a specifically crafted default branch name. This allows a remote attacker to...
Security Scorecards - Security Health Metrics For Open Source
Security Health Metrics For Open Source Motivation A short motivational video clip to inspire us: https://youtu.be/rDMMYT3vkTk "You passed! All D's ... and an A!" Goals 1. Automate analysis and trust decisions on the security posture of open source projects. 2. Use this data to proactively improv...
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13 a branch can be mispredicted (e.g. because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack aka CID-9183671af6db.
...
