CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438

Removed by vendor...

LogicalDoc Community Edition XXE Vulnerability

LogicalDoc CommunityEdition is a document management system developed using Java technology . The system has Lucene full-text search index and automatic import and other functions . An XML injection vulnerability exists in LogicalDoc CommunityEdition 7.5.3 and earlier versions. No details of the...

CVE-2017-1000022

LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation...

CVE-2017-1000022

LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation...

CVE-2017-1000023

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document...

Hardcoded credentials

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document...

CVE-2017-1000023

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document...

CVE-2017-1000021

LogicalDoc Community Edition 7.5.3 and earlier is vulnerable to an XML External Entity (XXE) issue when indexing XML documents. The CNVD-entry CNVD-2017-24536 identifies this as an XML injection vulnerability affecting the same version range; CNVD-2017-24537 covers a related cross-site scripting ...

CVE-2017-1000023

Affected software : LogicalDoc Community Edition (Java-based DMS) prior to 7.5.3. Vulnerability : Cross-site scripting (XSS) in the HTML document preview feature. Root cause: improper sanitization/execution of user-controlled content in the preview flow (document HTML preview). Impact : attacker ...

CVE-2017-1000022

The CVE-2017-1000022 entry concerns LogicalDoc Community Edition 7.5.3 and earlier, where an incorrect access control issue can lead to privilege escalation. Public references across NVD and CNVD describe the vulnerability as an elevation of privileges due to improper rights management within the...

GSM Community Edition and lagging OpenVAS Plugin Feed

As I already wrote in "Installing OpenVAS 9 from the sources", since May 2017 OpenVAS 9 is available in a form of free virtual appliance. It is called GSM Community Edition GCE and is based on Greenbone commercial product GSM ONE. What's the difference between GSM ONE and free GCE? GSM Community...

CVE-2016-5072

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

Cross site request forgery (csrf)

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

CVE-2016-5072

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

Teradata Virtual Machine Community Edition Elevation of Privilege Vulnerability

Teradata Virtual Machine Community Edition is a Teradata virtual container packaged with the SUSE Linux Enterprise Server SLES operating system and Teradata databases to run in a virtualized environment on third-party hardware. A security vulnerability exists in Teradata Virtual Machine Community...

Teradata Virtual Machine Community Edition 15.10 Insecure File Permission Vulnerability

Teradata Virtual Machine Community Edition version 15.10 suffers from an insecure file permission vulnerability. Title: Teradata Virtual Machine Community Edition v15.10 has insecure file permission Author: Larry W. Cashdollar, @larry0 Date: 2016-10-01 Download Site:...

CVE-2016-7489

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

Code injection

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...