PT-2023-8379 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.6.0 through 2.7.3 Description: The issue is related to a stored XSS vulnerability that allows a DAG author to add unbounded and not-sanitized JavaScript in the parameter description field of the DAG. This JavaScript...

SmarterTools SmarterMail Security Breach

SmarterTools SmarterMail is a set of mail server software from SmarterTools. The software supports spam filtering, statistics, Simple Mail Transfer Protocol SMTP authentication, and other features. A security vulnerability exists in SmarterTools SmarterMail versions 8495 through 8664, which stems...

CVE-2023-3949

An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint...

Design/Logic Flaw

An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint...

CVE-2023-3949

Summary: CVE-2023-3949 affects GitLab versions 11.3–16.4.3, 16.5–16.5.3, and 16.6–16.6.1. An unauthorized user could view a public project’s release descriptions via an atom endpoint when release access on the public was restricted to project members. The issue’s base CVSSv3.1 score is 5.3 (Mediu...

CVE-2023-3949

Removed by vendor...

CVE-2023-3949 Insertion of Sensitive Information Into Sent Data in GitLab

An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint...

PT-2023-26976 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.3 through 16.4.2 GitLab versions 16.5 through 16.5.2 GitLab versions 16.6 through 16.6.0 Description: An issue has been discovered in GitLab where unauthorized users could view public projects' release descriptions via an...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. GitLab suffers from a security vulnerability that stems from the fact that...

Pachno Cross-Site Scripting Vulnerability

Pachno is an open source platform for collaboration from Pachno Open Source. A cross-site scripting vulnerability exists in Pachno version 1.0.6, which stems from insufficient validation of inputs in project descriptions and comments, allowing an attacker to inject malicious java script...

Grocy Cross-Site Scripting Vulnerability

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A cross-site scripting vulnerability exists in Grocy version v.4.0.3, which stems from a cross-site scripting XSS vulnerability in the product description component of the api/stock/products endpoint. An...

CVE-2023-43764

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-43762. Reason: This candidate is a duplicate of CVE-2023-43762. Notes: All CVE users should reference CVE-2023-43762 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage...

XXE (XML External Entity Injection) in Jira Service Management Data Center and Server - CVE-2019-13990

h2. Summary of Vulnerability Certain versions of Jira Service Management Server & Data Center were affected by CVE-2019-13990. The affected versions contained vulnerable versions of Terracotta Quartz Scheduler which allowed authenticated attackers to initiate an XML External Entity injection atta...

Input validation

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user...

PT-2023-16027 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.0 through 16.1.4 GitLab versions 16.2 through 16.2.4 GitLab versions 16.3 through 16.3.0 Description: An issue has been discovered due to improper permission validation, allowing an unauthorized user to edit label...

CVE-2020-19186

A flaw was found in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a buffer over-read, resulting in an application crash. Mitigation Do not compile or decompile untrusted terminfo descriptions...

CVE-2023-28779

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...

CVE-2023-28779

CVE-2023-28779 affects the WordPress plugin “Terms descriptions” by Vladimir Statsenko. The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) in terms descriptions plugin versions ≤ 3.4.4. The issue arises from the plugin’s handling of input that can be reflected in output,...

CVE-2023-28779 WordPress Terms descriptions Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Vladimir Statsenko Terms descriptions plugin = 3.4.4 versions...