PT-2023-16027 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.0 through 16.1.4 GitLab versions 16.2 through 16.2.4 GitLab versions 16.3 through 16.3.0 Description: An issue has been discovered due to improper permission validation, allowing an unauthorized user to edit label...

CVE-2020-19186

A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a buffer over-read, resulting in an application crash. Mitigation Do not compile or decompile untrusted terminfo descriptions...

CVE-2023-28779

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...

CVE-2023-28779

CVE-2023-28779 affects the WordPress plugin “Terms descriptions” by Vladimir Statsenko. The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) in terms descriptions plugin versions ≤ 3.4.4. The issue arises from the plugin’s handling of input that can be reflected in output,...

CVE-2023-28779 WordPress Terms descriptions Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...

WordPress Plugin Vladimir Statsenko Terms descriptions Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-21955 · Vladimir Statsenko · Terms Descriptions Plugin

Name of the Vulnerable Software and Affected Versions: Vladimir Statsenko Terms descriptions plugin versions = 3.4.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles issue descriptions. An attacker can exploit this vulnerability to inject malicious code into an issue description, which can then be executed by other users when they...

Improper Access Control

gitlab is vulnerable to Improper Access Control. This vulnerability allows unprivileged users using the REST API to change labels descriptions...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists due to the lack of length validation of the library, which allows an attacker to create large issue descriptions via GraphQL, leading to an application crash...

PT-2023-33019 · Vendure · Vendure

Name of the Vulnerable Software and Affected Versions: Vendure affected versions not specified Description: The issue concerns an authorization system with different levels of privileges. In the admin UI, certain description inputs, such as those for inventory, collection catalog, shipping method...

CVE-2023-0921

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage...

Input validation

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage...

CVE-2023-0921 Allocation of Resources Without Limits or Throttling in GitLab

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage...

PT-2023-16619 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.3 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: A lack of length validation in GitLab CE/EE allows an authenticated attacker to create a large Issue...

Google to pay $40m for "deceptive and unfair" location tracking practices

Google is going to pay $39.9 million to Washington State to put to rest a lawsuit about its location tracking practices which has been in play since last year. Google was accused of "misleading consumers" by State Attorney General Bob Ferguson. From the AG press release: Attorney General Bob...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from an insecure direct...

PT-2023-2596 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 11.1.7 and earlier, 11.2.x before 11.2.4, 11.3.x before 11.3.1 Description: An issue was discovered related to the "merge request approvals" feature, where attackers could obtain sensitive information about...

PT-2023-17245 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab where a search timeout could be triggered if a specific HTML payload was used in the issue description...