Deserialization of untrusted data

illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg concurrently over a single socket, because uts/common/inet/ip/ipattr.c mishandles connixa dereferences...

DLL Hijacking Vulnerability in VV Video Community

VV Video Community is an online audiovisual entertainment platform. VV Video Community suffers from a DLL hijacking vulnerability. An attacker can exploit the vulnerability to execute arbitrary code...

React Prereleases-Preparing for the Future

By Owais Sultan Recently, React has come up with prerelease channels to update users with the latest changes taking place in the React ecosystem. They spoke about this through a blog published on their React website. React relies on an open-source community to report bugs, open pull requests and...

CVE-2019-14904

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...

Improper access control

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control...

CVE-2019-18446

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions issue 1 of 2...

UBUNTU-CVE-2019-18448

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control...

CVE-2019-18455

An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop...

CVE-2019-18447

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions...

UBUNTU-CVE-2019-18449

An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions issue 2 of 2...

UBUNTU-CVE-2019-18447

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions...

UBUNTU-CVE-2019-18450

An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions...

CVE-2019-18446

CVE-2019-18446 affects GitLab Community and Enterprise Edition 8.15–12.4, describing an Insecure Permissions issue (issue 1 of 2). The connected Red Hat, SUSE, Debian, and OSV sources corroborate the same vulnerability description. No exploit details are provided in the documents. Impact details ...

CVE-2019-18450

The CVE-2019-18450 entry concerns GitLab Community and Enterprise Edition before 12.4, where the Project labels feature allowed insecure permissions. The vulnerability affects GitLab CE/EE components related to label handling, enabling permission issues as described in the CVE description. In-ses...

CVE-2019-18455

Removed by vendor...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions issue 2 of 4...

CVE-2019-18458

An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions issue 2 of 4...

CVE-2019-18459

An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions issue 3 of 4...

CVE-2019-18461

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control...

Insecure Random Number Generator

magento/community-edition uses an insecure random number generator. The application uses a cryptographically insecure PHP rand function to generate a random number for the initialization vector, making it easier for remote attackers to defeat cryptographic protection mechanisms...