PT-2020-13499 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3 through 13.3.8 GitLab CE/EE versions 13.4 through 13.4.4 GitLab CE/EE versions 13.5 through 13.5.1 Description: A vulnerability in the internal Kubernetes agent api in GitLab CE/EE allows unauthorized access to...

PT-2020-16412 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.8 through 13.3.8 GitLab CE/EE versions 13.4 through 13.4.4 GitLab CE/EE versions 13.5 through 13.5.1 Description: A path traversal vulnerability in the package upload functionality allows an attacker to save packages ...

GitLab CE/EE Improper Authorization Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An imprope...

PT-2020-13492 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 13.3.9 GitLab CE/EE versions 13.4.0 through 13.4.5 GitLab CE/EE versions 13.5.0 through 13.5.2 Description: Insufficient permission checks in the scheduled pipeline API allow an attacker to read variable nam...

PT-2020-13491 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3.0 through 13.3.8 GitLab CE/EE versions 13.4.0 through 13.4.4 GitLab CE/EE versions 13.5.0 through 13.5.1 Description: A CSRF issue in the runner administration page of GitLab CE/EE allows an attacker to target GitLa...

GitLab CE/EE Denial of Service Vulnerability (CNVD-2020-65166)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE/EE 12.6 and...

Windows 10, iOS, Chrome, Firefox and Others Hacked at Tianfu Cup Competition

Multiple software products from Adobe, Apple, Google, Microsoft, Mozilla, and Samsung were successfully pwned with previously unseen exploits in Tianfu Cup 2020, the third edition of the international cybersecurity contest held in the city of Chengdu, China. "Many mature and hard targets have bee...

Vulnerabilities fixed in GitLab

Several vulnerabilities have been fixed in GitLab. The vulnerabilities potentially allow a malicious person to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Remote code execution User Rights Access to sensitive da...

Vulnerability Detection Pipeline (Beta)

Update October 22, 2020: The Vulnerability Detection Pipeline beta has been updated to include detections of all severities. It now gives visibility into upcoming and recently published detections with severity 3, 2 and 1 in addition to severity 5 and 4. The pipeline also supports a URL parameter...

vtenext cross-site scripting vulnerability

vtenext is a unique open source CRM + BPM solution for comprehensive management of leads, contacts and customers. A cross-site scripting vulnerability exists in the Messaging module of vtenext version 19 CE. The vulnerability can be exploited to inject arbitrary JavaScript code via the "From" fie...

CVE-2020-10228

A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote code execution...

PT-2020-13441 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3 through 13.3.3 Description: The issue concerns an OAuth authorization scope change without user consent in the middle of the authorization flow. Recommendations: For GitLab CE/EE versions 13.3 through 13.3.3, update...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

Sql injection

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

OpenSIS Community Edition 7.3 is affected by CVE-2020-6637: a SQL injection through the USERNAME parameter in index.php. The Nuclei template confirms SQLi in OpenSIS 7.3 and describes the impact as the ability to execute arbitrary SQL queries, potentially leading to data access or manipulation. T...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

Contrast Community Edition Empowers Developers to Write Secure Code Faster

As software eats the world, the world faces a software security crisis. The movement to modern software such as cloud technologies and microservice architectures is essential to innovate quickly. Yet, nearly three in four developers say that security slows down Agile and DevOps. Neither developer...

Aerospike Operating System Command Injection Vulnerability

Aerospike is a NoSQL database solution from Aerospike, Inc. A security vulnerability exists in Aerospike Community Edition version 4.9.0.5. An attacker with a specially crafted UDF can exploit the vulnerability to execute arbitrary operating system commands on all nodes of the cluster with curren...

CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...