Code injection

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

CVE-2018-18635

MailCleaner CE is affected by CVE-2018-18635, a cross-site scripting vulnerability in the admin login interface. The issue is in www/guis/admin/application/controllers/UserController.php and can be exploited via PATH_INFO on the admin/login/user/message/ page to inject arbitrary script/HTML. Repo...

CVE-2018-18635

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATHINFO...

IoT Adventures: The LeFun WiFi Camera

Recently I happened to be in the market for a baby monitor, so I decided to search Amazon for an affordable device that would fit my needs. A search for "baby monitor" within the "electronics" department brought me to the LeFun WiFi Camera. For $39.99 at the time of my purchase, this seemed like ...

CVE-2018-12605

An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'urlfor' contained a XSS issue due to it allowing arbitrary protocols as a parameter...

CVE-2018-12606

GitLab CE/EE versions prior to 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1 contain a persistent XSS in the wiki due to lack of output encoding in a specific markdown feature. Mitigation: upgrade to 10.7.6, 10.8.5, or 11.0.1+ (the fixed versions). Other details across sources corroborate ...

ce-os.eu XSS vulnerability

Open Bug Bounty ID: OBB-627653 Description| Value ---|--- Affected Website:| ce-os.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ce-mir.fr XSS vulnerability

Open Bug Bounty ID: OBB-626542 Description| Value ---|--- Affected Website:| ce-mir.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10379

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability...

CVE-2018-10379

GitLab CE/EE (GitLab) before versions 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2 contain a persistent XSS in the Move Issue feature. The vulnerability arises from improper sanitization in the Move Issue UI, allowing stored script injection via issue fields. Impact is conditional on in...

Microsoft Windows: WPD Devices: Deny write access

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winwpddenywriteaccess.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for WPD Devices: Deny write access Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program ...

CVE-2017-0918

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

CVE-2017-0917

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

Input validation

Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution...

CVE-2017-0915

CVE-2017-0915 affects GitLab Community Edition 10.2.4, due to a lack of input validation in GitlabProjectsImportService, enabling remote code execution. Public/connected sources confirm arbitrary code execution via project import; remediations in the supplied docs point to upgrading to fixed GitL...

CVE-2017-0926

GitLab Community Edition 10.3 is affected by an improper authorization in the Oauth sign-in component, enabling unauthorized user login. Root cause: OAuth sign-in bypass allows login without proper authorization. Impact: unauthorized access via OAuth flow with partial/ high impact credentials (pe...

CVE-2017-0923

Removed by vendor...

CVE-2017-0915

Removed by vendor...

CVE-2017-0924

CVE-2017-0924 affects GitLab Community Edition 10.2.4, with a lack of input validation in the labels component that enables persistent cross-site scripting (XSS). Multiple sources (NVD entry for CVE-2017-0924, OpenVAS NASL, CNVD entry) corroborate that the vulnerability is tied to the labels comp...

CVE-2017-0917

CVE-2017-0917: GitLab Community Edition v10.2.4 vulnerability in the CI job component due to lack of input validation, causing persistent cross-site scripting. Confirmed details across multiple sources indicate a remote attacker could inject arbitrary script via CI job output, leading to potentia...