PT-2024-6775 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.5 through 17.2.9 GitLab EE versions 17.3 through 17.3.5 GitLab EE versions 17.4 through 17.4.2 Description: The issue is related to errors in access control, allowing a remote attacker to run Continuous...

The vulnerability of the EC2 Cloud Profile module in the Continuous Integration and Delivery application delivery system of JetBrains TeamCity allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the EC2 Cloud Profile module in the Continuous Integration and Delivery application delivery system CI/CD of JetBrains TeamCity is related to insufficient protection for registration data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain...

CVE-2024-9294 dingfanzu CMS saveNewPwd.php sql injection

A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected by this issue is some unknown functionality of the file saveNewPwd.php. The manipulation of the argument username leads to sql injection. The attack may be...

CVE-2024-9291 kalvinGit kvf-admin XML File cross site scripting

A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function of the file /ueditor/upload?configPath=ueditor/config.json&action=uploadfile of the component XML File Handler. The manipulation of the...

CVE-2024-9280

A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be...

CVE-2024-9280 kalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload

A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. Octopus Server has a security vulnerability that stems from a weak content security policy...

CVE-2024-8367

A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component...

CVE-2024-8367

HM Courts & Tribunals Service Probate Back Office is affected by CVE-2024-8367. Affected component: Markdown Handler, specific file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java. Root cause is a manipulation that leads to injection. Public details do not specify affected ver...

CVE-2024-8367 HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection

A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component...

CVE-2024-8367 HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection

A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component...

CVE-2024-8332

CVE-2024-8332 affects master-nan Sweet-CMS (up to commit 5f441e022b8876f07cde709c77b5be6d2f262e3f). The vulnerability is a SQL injection in unknown code of the file /table/index, enabling remote exploitation. The issue is described as critical. Remediation provided in the sources is to apply patc...

CVE-2024-8302

CVE-2024-8302 affects dingfanzu CMS (up to the latest listed build). The vulnerability exists in the /ajax/chpwd.php endpoint where the username parameter can be manipulated to trigger a SQL injection. The impact is confirmed as remote code/data access (high severity): unauthorized access to data...

CVE-2024-8302 dingfanzu CMS chpwd.php sql injection

A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched...

CVE-2024-8138 code-projects Pharmacy Management System Parameter index.php editManager sql injection

A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. Affected is the function editManager of the file /index.php?action=editManager of the component Parameter Handler. The manipulation of the argument id as part of String leads to sql...

CVE-2024-8135 Go-Tribe gotribe token.go Sign hard-coded credentials

A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling...

CVE-2024-8135 Go-Tribe gotribe token.go Sign hard-coded credentials

A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling...

CVE-2024-8135

Summary: CVE-2024-8135 affects Go-Tribe gotribe (up to commit cd3ccd32...) with a vulnerability in the Sign function of pkg/token/token.go. The issue arises from manipulation of the config.key argument, which leads to hard-coded credentials. Reported in multiple feeds, the product uses continuous...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. A security vulnerability exists in Octopus Server that stems from a cookie using the wrong expiration time...

The vulnerability of the ignoreDifferences configuration in the declarative delivery tool for GitOps for Kubernetes Argo CD allows a attacker to trigger a service failure.

The vulnerability of the ignoreDifferences configuration option in GitOps’ continuous delivery tool for Kubernetes Argo CD is related to an uncontrolled resource consumption when processing the jqPathExpressions parameter. Exploiting this vulnerability could allow a malicious actor to cause servi...