3038 matches found
CVE-2023-5198
Removed by vendor...
CVE-2023-5198: Incorrect Authorization
An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys...
PT-2023-31905 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 16.2.7 GitLab versions 16.3 through 16.3.5 GitLab versions 16.4 through 16.4.1 Description: An issue has been discovered in GitLab where a removed project member could write to protected branches using deploy keys...
Security Bulletin: IBM UrbanCode Deploy (UCD) under certain configurations could allow an authenticated user to make changes to environment template due to improper authentication controls.
Summary IBM UrbanCode Deploy UCD under certain configurations could allow an authenticated user to make changes to environment template due to improper authentication controls CVE-2023-40376 Vulnerability Details CVEID:CVE-2023-40376 DESCRIPTION: IBM UrbanCode Deploy UCD under certain...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy
Summary Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy UCD. Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity XXE declarations by the XML parser. CVE-2022-46751 Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could...
com.heroku.sdk:heroku-deploy (2.0.7), com.heroku.sdk:heroku-maven-plugin (2.0.7) +36 more potentially affected by CVE-2023-4759 via org.eclipse.jgit:org.eclipse.jgit (4.11.5.201810191925-r)
org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.11.5.201810191925-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - com.heroku.sdk:heroku-deploy 2.0.7 - com.heroku.sdk:heroku-maven-plugin 2.0.7...
Improper Authorization
gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to obtain the public fingerprint and name of a Deploy Key for a public project. This information could then be used to impersonate the project owner and deploy malicious code to the project...
Improper Authentication
gitlab is vulnerable to Improper Authentication. The vulnerability occurs due to incorrect authentication with package registries when IP restrictions are configured resulting in allowing a malicious attacker to misuse a deploy token from any location...
Improper Authorization
gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to update the status of an external status check to "success", even if the check has failed. This could cause GitLab to deploy code or release a package that is not ready, which could lead to security...
Incorrect Authorization
gitlab is vulnerable to Incorrect Authorization. This allows a malicious attacker in possession of a project deploy token to use it from any location even if IP address restrictions were set...
Incorrect Authorization
gitlab is vulnerable to Incorrect Authorization. This allows a malicious attacker in possession of a project deploy token to use it from any location even if IP address restrictions were set...
CVE-2022-2416
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...
CVE-2022-2416
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...
Design/Logic Flaw
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...
CVE-2022-2416
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...
CVE-2022-2416
CVE-2022-2416 affects Octopus Deploy. A low-privileged guest can craft a request that allows enumeration of an environment, per the CVE descriptions across NVD/Red Hat/other sources. The connected documents confirm the existence of the vulnerability and its basic impact (environment enumeration) ...
CVE-2022-2416
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment...
CVE-2022-2346
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints...