CVE-2018-19571

GitLab CE/EE is affected by CVE-2018-19571 (SSRF in webhooks) affecting versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1. Connected documents show public exploit entries indicating this SSRF can lead to remote code execution in GitLab 11.4.7/11.4.x and authentic...

CVE-2018-19574

GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page...

CVE-2018-19574

GitLab CE/EE is affected by an XSS on the OAuth authorization page in versions 7.6–11.x prior to 11.3.11, 11.4 prior to 11.4.8, and 11.5 prior to 11.5.1. The issue is a cross-site scripting vulnerability on the OAuth flow. Remediation per sources is to upgrade to fixed releases: 11.3.11+, 11.4.8+...

CVE-2018-19569

GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization flaw that lets a user access the web UI using a Personal Access Token of any scope. The root cause is an authorization issue that improperly permits PAT-authenticat...

CVE-2018-19569

Removed by vendor...

CVE-2018-19575

CVE-2018-19575 affects GitLab CE/EE: versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1 are vulnerable to an insecure direct object reference that allows a user to comment on a locked issue. Root cause is an insecure direct object reference in issue commenting log...

CVE-2018-19576

GitLab CE/EE versions 8.6–11.x are vulnerable to an access-control issue that allows a Guest to change or delete their own comments on an issue after it is marked Confidential. Root cause: improper enforcement of access to issue comments. Affected ranges: 11.3.11+ fixes for 11.3.x line, 11.4.8+ f...

CVE-2018-19576

Removed by vendor...

CVE-2018-19570

GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags...

CVE-2018-19570

CVE-2018-19570 affects GitLab CE/EE: GitLab versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1 are vulnerable to an XSS in Markdown fields caused by unrecognized HTML tags. The issue is documented across multiple sources (NVD, OSV, CNVD, CVE listings, and vendor advisories)....

CVE-2018-19570

Removed by vendor...

CVE-2018-19577

Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue...

CVE-2018-19573

GitLab CE/EE (versions 10.3 through 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1) are affected by an XSS in Markdown fields via Mermaid. Root cause: unsafe rendering of Mermaid content in Markdown. Impact is XSS in affected Markdown fields; no exploit status provided in the doc...

CVE-2018-19573

Removed by vendor...

CVE-2018-19577

GitLab CE/EE (versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1) is affected by an incorrect access control vulnerability that allows an unauthorized user to see the title and namespace of a confidential issue. Root cause: improper access control in issue metadata...

PT-2019-9866 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.0 up to 11.3.10 GitLab CE/EE versions 11.4 up to 11.4.7 GitLab CE/EE versions 11.5 up to 11.5.0 Description: The issue allows administrators with access to the logs to see another user's token, as access tokens are...

Qualys Cloud Platform (VM, PC) 8.20 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...

Rockwell Automation/Allen-Bradley PanelView Plus CE 6 700 HMI Terminal

Binary data 751117.prm...

Updated docker packages fix security vulnerability

Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork: CVE-2018-16873: cmd/go: remote command execution during "go get -u" bsc1118897 CVE-2018-16874: cmd/go: directory traversal in "go get" via curly braces in import paths bsc1118898 CVE-2018-16875:...

CVE-2018-19585

CVE-2018-19585 covers CRLF Injection in GitLab CE/EE Project Mirroring when using the Git protocol. Affected: GitLab versions 8.18–11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The root cause is CRLF injection in mirroring requests; public material references exploitation o...