Security Bulletin: A security vulnerability has been identified in SQLite shipped with PowerAI.

Summary Vulnerability CVE-2019-19317 found in SQLite package. Vulnerability Details CVEID: CVE-2019-19317 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by an error in lookupName in resolve.c. By providing specially crafted input, a remote attacker could exploit this vulnerabili...

Security Bulletin: A security vulnerability has been identified in SQLite shipped with PowerAI.

Summary Multiple vulnerabilities CVE-2019-19242 and CVE-2019-19244 found in SQLite package. Vulnerability Details CVEID: CVE-2019-19242 DESCRIPTION: An unspecified error with the mishandling of pExpr-y.pTab in the sqlite3ExprCodeTarget function in expr.c in SQLite has an unknown impact and attack...

Security Bulletin: A security vulnerability has been identified in libjpeg-turbo shipped with PowerAI.

Summary Vulnerability CVE-2019-2201 found in libjpeg-turbo package. Vulnerability Details CVEID: CVE-2019-2201 DESCRIPTION: libjpeg-turbo could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow and subsequent heap corruption. By persuading a victim to...

CVE-2014-9127

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

CVE-2014-9127

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2014-9126

CVE-2014-9126 affects Open-School Community Edition 2.2. The vulnerability is described as multiple cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary script/HTML via the YII_CSRF_TOKEN HTTP cookie or through the StudentDocument, StudentCategories, and StudentPrevio...

CVE-2014-9126: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

PT-2020-7770

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue concerns improper access restriction to the export functionality. Remote authenticated users can obtain sensitive information by exploiting this weakness. Specifically, the "r"...

PT-2020-7769

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the YII CSRF TOKEN HTTP cookie ...

CVE-2014-9127: Exposure of Sensitive Information to an Unauthorized Actor

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

Open-School Community Edition Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School Community Edition version 2.2. The vulnerabili...

CVE-2013-4582

Removed by vendor...

Cross site request forgery (csrf)

An IDOR exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a project owner or maintainer to see the members of any private group via merge request approval rules...

Information disclosure

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

Code injection

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

CVE-2019-15578

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

PT-2020-9721

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.5 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.8 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.14...

PT-2020-9714

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...