QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from cross site request forgery and weak access control vulnerabilities. ------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice...

QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability

QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...

QRadar Community Edition 7.3.1.6 Cross Site Scripting Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from a reflective cross site scripting vulnerability in the Forensics link analysis page. ------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page...

QRadar Community Edition 7.3.1.6 Arbitrary Object Instantiation Vulnerability

QRadar Community Edition version 7.3.1.6 is vulnerable to instantiation of arbitrary objects based on user-supplied input. An authenticated attacker can abuse this to perform various types of attacks including server-side request forgery and potentially arbitrary execution of code...

QRadar Community Edition 7.3.1.6 Path Traversal Vulnerability

QRadar Community Edition version 7.3.1.6 has a path traversal that exists in the session validation functionality. In particular, the vulnerability is present in the part that handles session tokens UUIDs. QRadar fails to validate if the user-supplied token is in the correct format. Using path...

CVE-2020-11505

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

Design/Logic Flaw

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

CVE-2020-11505

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

PT-2020-12652 · Microsoft +1 · Nuget +2

Name of the Vulnerable Software and Affected Versions: GitLab Community Edition CE versions 12.7.x through 12.7.8 GitLab Community Edition CE versions 12.8.x through 12.8.8 GitLab Community Edition CE versions 12.9.x through 12.9.2 GitLab Enterprise Edition EE versions 12.7.x through 12.7.8 GitLa...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control

------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice ------------------------------------------------------------------------ Yorick Koster, September 2019...

QRadar Community Edition 7.3.1.6 Cross Site Scripting

------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page ------------------------------------------------------------------------ Yorick Koster, September 2019...

QRadar Community Edition 7.3.1.6 Path Traversal

------------------------------------------------------------------------ QRadar session manager path traversal vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2019...

Unspecified Vulnerability in GitLab EE/CE

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab EE/CE, no detai...

Unspecified Vulnerability in GitLab EE/CE (CNVD-2020-22241)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab EE/CE, which ca...

GitLab EE/CE Information Disclosure Vulnerability (CNVD-2020-22239)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab EE/CE Information Disclosure Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab EE/CE Information Disclosure Vulnerability (CNVD-2020-22238)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

PT-2020-12466 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 9.0 through 12.9 Description: The issue allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. Recommendations: For GitLab EE/CE versions 9.0 through 12.9, consider...

OTRS Information Disclosure Vulnerability (CNVD-2020-22202)

Open-source Ticket Request System OTRS is an open-source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the...

CVE-2020-1773

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects OTRS Community Edition:...