1366 matches found
UBUNTU-CVE-2022-2527
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...
CVE-2022-2527
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...
CVE-2022-2527: Improper Neutralization of Input During Web Page Generation
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...
CVE-2022-2527
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...
Design/Logic Flaw
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin = 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension plugin AccessiBe...
CVE-2021-36913 Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin = 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension plugin AccessiBe...
CVE-2021-36913
The CVE-2021-36913 issue affects the WordPress plugin Redirection for Contact Form 7 (WPCF7-Redirect) up to version 2.4.0. The vulnerability allows unauthenticated attackers to change plugin options and inject scripts into the footer HTML when the AccessiBe extension is present. This is triggered...
CVE-2021-36913: Improper Access Control
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin = 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension plugin AccessiBe...
PT-2022-10604
Name of the Vulnerable Software and Affected Versions Qube One Redirection for Contact Form 7 plugin version 2.4.0 and earlier Description The issue allows unauthenticated attackers to change options and inject scripts into the footer HTML, potentially leading to content injection. This requires ...
FreeBSD : Gitlab -- Multiple vulnerabilities (04422df1-40d8-11ed-9be7-454b1dd82c64)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 04422df1-40d8-11ed-9be7-454b1dd82c64 advisory. - Gitlab reports: Denial of Service via cloning an issue Arbitrary PUT request as victim user...
WordPress Redirection for Contact Form 7 plugin <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability
Unauthenticated Options Change vulnerability discovered by mirphak Patchstack Alliance in WordPress Redirection for Contact Form 7 plugin versions = 2.4.0. Successful exploitation requires an additional extension plugin AccessiBe. An attacker can inject a script into the footer. Solution Update t...
Gitlab -- Multiple vulnerabilities
Gitlab reports: Denial of Service via cloning an issue Arbitrary PUT request as victim user through Sentry error list Content injection via External Status Checks Project maintainers can access Datadog API Key from logs Unsafe serialization of Json data could lead to sensitive data leakage Import...
Security Bulletin: Informix JDBC Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)
Abstract Java API Documentation contains a frame injection vulnerability. Content CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the documentation which injects...
PT-2022-6734
Name of the Vulnerable Software and Affected Versions cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4 Description The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP...
FreeBSD : Gitlab -- multiple vulnerabilities (e6b994e2-2891-11ed-9be7-454b1dd82c64)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b994e2-2891-11ed-9be7-454b1dd82c64 advisory. - Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Conte...
Gitlab -- multiple vulnerabilities
Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Content injection via Incidents Timeline description Lack of length validation in Snippets leads to Denial of Service Group IP allow-list not fully respected by the Package Registry Abusing Gitaly.GetTreeEntrie...
SUSE-SU-2022:2885-1 Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2022-32209: Fixed a potential content injection under specific configurations bsc1201183...
SUSE-SU-2022:2870-1 Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2022-32209: Fixed a potential content injection under specific configurations bsc1201183...
PT-2022-23991 · Unknown · Opennebula
Name of the Vulnerable Software and Affected Versions: OpenNebula affected versions not specified Description: The issue allows for File Content Injection due to an Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula core on Linux. Recommendations: At the moment, there is ...
