PT-2020-16422 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.1 through 13.4.7 GitLab CE/EE versions 13.5 through 13.5.5 GitLab CE/EE versions 13.6 through 13.6.2 Description: The issue concerns information disclosure via GraphQL, exposing private group and project membership...

Aerospike Database UDF Lua Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Aerospike Database UDF Lua Code Execution', 'Description' = %q Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to...

PT-2020-16419 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.4 through 13.6.1 Description: An issue has been discovered in GitLab CE/EE, where information disclosure via GraphQL results in user email being unexpectedly visible. Recommendations: For versions 13.4 through 13.6.1,...

Aerospike Database UDF Lua Code Execution Exploit

Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to call the os.execute Lua function. This Metasploit module creates a UDF utilizing this function to execute arbitrary operating system commands with the privileges of the user running the Aerospike service. This modu...

UBUNTU-CVE-2020-26407

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project...

PT-2020-16414 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 12.4 through 13.4.6 Gitlab CE/EE versions 13.5 through 13.5.4 Gitlab CE/EE versions 13.6 through 13.6.1 Description: A cross-site scripting issue exists that allows an attacker to perform cross-site scripting to other...

Gitlab CE/EE Cross-Site Scripting Vulnerability

GitLab is a product of GitLab, a self-hosted, Git version control system project repository application developed using Ruby on Rails.Git is a free, open source, distributed version control system.Former is a form builder for Laravel and other frameworks.ibus is an input framework for Linux/Unix...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

Cross site scripting

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27408

OpenSIS Community Edition up to version 7.6 is affected by an access-control flaw in ResetUserInfo.php that lets an unauthenticated attacker change arbitrary user passwords. The root cause is improper access controls on the ResetUserInfo.php endpoint, enabling password modification without authen...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27408

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. The issue is consistently described across connected sources as CVE-2020-27409. No explicit exploit details or patch version are provided in the connecte...

CVE-2020-27409

OpenSIS Community Edition before 7.5 is affected by a cross-site scripting XSS vulnerability in SideForStudent.php via the modname parameter...

OpenSIS Community Edition Cross-Site Scripting Vulnerability

Open Solutions For Education openSIS is an open source student information management system from Open Solutions for Education Open Solutions For Education. A cross-site scripting vulnerability exists in OpenSIS Community Edition versions prior to 7.5, which stems from being affected by the...

PT-2020-16685

Name of the Vulnerable Software and Affected Versions OpenSIS Community Edition versions through 7.6 Description The issue is related to incorrect access controls for the file ResetUserInfo.php, allowing an unauthenticated attacker to change the password of arbitrary users. Recommendations For...