PT-2020-11135

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.14 and later Description An information disclosure issue was discovered, which could result in the disclosure of the newly created issue ID when using the move issue feature. Recommendations For GitLab CE/EE versions 8....

PT-2020-9717

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2...

PT-2020-9718

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...

PT-2020-11136

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.5 and later Description A security issue was found that allows the disclosure of label names through the new merge requests endpoint. Recommendations For GitLab CE/EE versions 11.5 and later, consider restricting acces...

CVE-2020-7934: Improper Neutralization of Input During Web Page Generation

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload wi...

PT-2020-11133

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.0 and later Description A privilege escalation issue was discovered when trigger tokens are not rotated once ownership of them has changed. Recommendations For GitLab CE/EE versions 9.0 and later, rotate trigger tokens...

PT-2020-11134

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.2 and later Description A flawed DNS rebinding protection issue was discovered in the url blocker.rb library, which could result in Server-Side Request Forgery SSRF where the library is utilized. Recommendations For...

CVE-2019-5464: Improper Input Validation

A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the urlblocker.rb which could result in SSRF where the library is utilized...

Security Bulletin: A security vulnerability has been identified in OpenCV shipped with PowerAI

Summary Multiple Vulnerabilities CVE-2019-14493, CVE-2019-14492 and CVE-2019-14491 were found in OpenCV package. Vulnerability Details CVEID: CVE-2019-14493 DESCRIPTION: An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at...

PT-2020-1388

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint CE Software affected versions not specified Cisco TelePresence Codec TC Software affected versions not specified Cisco RoomOS Software affected versions not specified Description A vulnerability in the...

openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2020-45)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Security issue fixed : - CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory bsc1152308. Bug fixes : - Update to Docker...

openSUSE: Security Advisory for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork (openSUSE-SU-2020:0045-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

CVE-2020-5197

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20142

CVE-2019-20142 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.3–12.6.1, allowing a Denial of Service . The Red Hat, NVD, OSV, and CVE records corroborate the DoS impact for GitLab CE/EE 12.3–12.6.1. The issued remediation in the public references indicates a patch r...

CVE-2019-20143

Affected product: GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. The issue is described as an Incorrect Access Control vulnerability. The connected Red Hat and OSV notes corroborate the same description; no further root-cause details are provided in the excerpts. The NVD entry li...

CVE-2019-20144

GitLab CVE-2019-20144 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 10.8 through 12.6.1, with a root cause described as Incorrect Access Control. The NVD CVSS entries indicate a Network attack vector, Low complexity, and Privileges Required: Low, yielding a medium sev...

CVE-2019-20146

Removed by vendor...

CVE-2019-20148

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

CVE-2020-5197

CVE-2020-5197 affects GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1–12.6.1 and is described as an Incorrect Access Control flaw. Connected sources confirm the affected software range and the nature of the issue; no exploit details are provided in the documents. A security release ...