Vulnerabilities fixed in GitLab

Vulnerabilities have been fixed in GitLab CE/EE. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS. Access to sensitive data Increased user privileges Gitlab has made updates available to address the...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab Community Edition that stems from...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from US-based GitLab with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An authorization issue vulnerability exists in GitLab Community Edition,...

GitLab 权限许可和访问控制问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A privilege license and access control issue vulnerability exists in GitLab...

The vulnerability in the web interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unified Communications Manager IM & Presence Service web interfaces is related to the manipulation of inter-site requests. Exploiting this vulnerability allows...

UBUNTU-CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1...

Security Bulletin: CVE-2021-2161 may affect IBM® SDK, Java™ Technology Edition used by IBM Data Studio Client

Summary CVE-2021-2161 was disclosed in the Oracle April 2021 Patch Update. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity...

Security Bulletin: Multiple vulnerabilities may affect IBM® Semeru Runtime

Summary This bulletin covers all applicable Java SE CVEs published by OpenJDK as part of their October 2021 Vulnerability Advisory, plus CVE-2021-41035. For more information please refer to OpenJDK's October 2021 Vulnerability Advisory and the X-Force database entries referenced below...

Security Bulletin: Security Vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - affect multiple IBM Continuous Engineering products based on IBM Jazz Technology

Summary There are multiple vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - Includes Oracle Oct 2020 CPU minus CVE-2020-14781 and CVE-2020-14782 and CVE-2020-14782 that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications:...

CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. I...

CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition for Windows prior to 2021.11 exposes weak file permissions on the embedded H2 database, enabling possible privilege escalation for an attacker that already has a valid Windows account on the server and may access sensitive configuration, database, and log...

Security Bulletin: CVE-2021-2341 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2021-2341 was disclosed as part of the Oracle July 2021 Critical Patch Update. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain sensitive information...

CVE-2021-44230: Incorrect Permission Assignment for Critical Resource

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. I...

openSUSE 15 Security Update : java-1_8_0-openjdk (openSUSE-SU-2021:3770-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3770-1 advisory. - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are...

SUSE SLES15: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2021:3770-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3770-1 advisory. Update to version OpenJDK 8u312 October 2021 CPU: - CVE-2021-35550: Fixed weak ciphers preferred over stronger ones for TLS...

PT-2021-7107 · Ldap +2 · Ldap +2

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 13.2.99.83 Tuleap Enterprise Edition versions prior to 13.1-6 Tuleap Enterprise Edition versions prior to 13.2-4 Description: The issue exists due to improper sanitization of the search filter built from the ldap id...

CVE-2021-41435: Improper Restriction of Excessive Authentication Attempts

A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56UV2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 SeriesRT-AX86U/RT-AX86S, RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400...

openSUSE 15 Security Update : java-11-openjdk (openSUSE-SU-2021:1480-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1480-1 advisory. - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are...

PT-2021-7108 · Unknown +1 · Tuleap Community Edition +3

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 13.2.99.31 Community Edition Tuleap versions prior to 13.1-5 Enterprise Edition Tuleap versions prior to 13.2-3 Enterprise Edition Description: The issue arises from improper sanitization of the search filter built fr...

SUSE SLED15: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2021:3671-1)

The remote SUSE Linux SLED15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3671-1 advisory. Update to 11.0.13+8 October 2021 CPU - CVE-2021-35550, bsc1191901: Update the default enabled cipher suites preference -...