4285 matches found
CVE-2020-13266
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...
CVE-2020-13266
CVE-2020-13266 affects GitLab CE/EE 12.8–13.0.1, with insecure authorization in Project Deploy Keys. The issue allows a user to update permissions on other users’ deploy keys under certain conditions. No exploitation details are provided in the supplied documents. Affected components: GitLab Depl...
CVE-2020-13266: Missing Authorization
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...
PT-2020-19298
Name of the Vulnerable Software and Affected Versions MuleSoft Mule CE/EE versions 3.8.x through 4.x released before April 7, 2020 Description A Denial of Service issue could allow remote attackers to submit data which can lead to resource exhaustion. Recommendations For versions 3.8.x, 3.9.x, an...
CVE-2020-6937: Undefined Security Weakness
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion...
TrixBox CE 2.8.0.4 Command Execution Exploit
This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpointdevicemap.php page. Successful exploitation allows for arbitrary command executi...
TrixBox CE 2.8.0.4 Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TrixBox CE endpointdevicemap.php Authenticated Command Execution', 'Description' = %q This module exploits an authenticated OS command injection...
CVE-2020-7351
An OS Command Injection vulnerability in the endpointdevicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012...
CVE-2020-7351 Fonality Trixbox CE Post-Authentication Command Injection
An OS Command Injection vulnerability in the endpointdevicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012...
ce-vacances.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1152792 Security Researcher DkilerS2 Helped patch 112 vulnerabilities Received 4 Coordinated Disclosure badges Received 8 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting ce-vacances.com website and...
TrixBox CE endpoint_devicemap.php Authenticated Command Execution
This module exploits an authenticated OS command injection vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4 inclusive in the "network" POST parameter of the "/maint/modules/endpointcfg/endpointdevicemap.php" page. Successful exploitation allows for arbitrary command execution on the...
CVE-2020-11649
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...
CVE-2020-11649
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...
CVE-2020-11649
CVE-2020-11649 affects GitLab CE/EE 8.15 through 12.9.2, where members of a group could retain access after the group is deleted. This is described as a design/logic flaw in multiple sources (e.g., BIT-GITLAB-2020-11649, CNVD-2020-25737, OSV: CVE-2020-11649). Impact is unauthorized access persist...
CVE-2020-11505
GitLab CE/EE prior to 12.7.9, 12.8.x prior to 12.8.9, and 12.9.x prior to 12.9.3 contain a vulnerability where a Workhorse bypass enables NuGet package and file disclosure via request smuggling, exposing sensitive information. A fix was released in GitLab 12.9.3 (and later). Affected components: ...
CVE-2020-11649: Missing Authentication for Critical Function
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...
Design/Logic Flaw
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
CVE-2020-10977
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...