Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The application allows an attacker to create unauthorized product discounts upon successful exploitation of the vulnerability...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2015-7450)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

ArticaTech Artica Proxy Path Traversal Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. A path traversal vulnerability exists in versions prior to ArticaTech Artica Proxy 4.30.000000 Community Edition. The vulnerability stems from a failure of a networked system or product to properly...

Directory traversal

Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter...

Unnamed Vulnerability in GitLab (CNVD-2021-19411)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

UBUNTU-CVE-2020-13262

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...

PT-2020-13406 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.5 through 13.0.1 Description: The issue allows users to bypass email verification. Recommendations: For GitLab CE/EE versions 12.5 through 13.0.1, update to a version that contains a fix for this issue...

PT-2020-13414 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.0 through 13.0.1 Description: A Denial of Service issue allows system resources to be exhausted. Recommendations: For GitLab CE/EE versions 12.0 through 13.0.1, update to a version later than 13.0.1 to resolve the iss...

PT-2020-13402 · Amazon +1 · Amazon Eks +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 through 13.0.1 Description: The issue allows other administrators to view Amazon EKS credentials via HTML source code, potentially leading to unauthorized access. Recommendations: For GitLab CE/EE versions 12.6...

PT-2020-13418 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.6 through 13.0.5 Description: An authorization issue in the mirroring logic allowed read access to private repositories. Recommendations: For GitLab CE/EE versions 10.6 through 13.0.5, update to a version later than...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-31223)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-20277)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-31225)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in the blobs...

PT-2020-13410 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.10 through 13.0.1 Description: A Reflected Cross-Site Scripting issue allowed the execution of arbitrary Javascript code on the Static Site Editor. Recommendations: For GitLab CE/EE versions 12.10 through 13.0.1, upda...

QuickBox Remote Code Execution Vulnerability

QuickBox is a media server application and service management system from the QuickBox team. The system supports the installation and management of applications using dashboards that enable users to interact with media servers. A remote code execution vulnerability exists in QuickBox Community...

QuickBox OS Command Injection Vulnerability

QuickBox is a media server application and service management system from the QuickBox team. The system supports the installation and management of applications using dashboards that enable users to interact with media servers. An operating system command injection vulnerability exists in QuickBo...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

CVE-2020-13695

CVE-2020-13695 affects QuickBox Community Edition up to 2.5.5 and QuickBox Pro up to 2.1.8. The local www-data user has passwordless sudo privileges to run grep as root, enabling an attacker to read sensitive files such as /root/*.db and /etc/shadow. This results in potential exposure of confiden...

CVE-2020-13448

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter...

CVE-2020-13694

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option...