137 matches found
The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE involves improper assignment of ownership rights. This allows attackers to launch attacks on domains by creating groups with names that match the unique domain names.
The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to improper assignment of ownership rights. Exploiting this vulnerability allows a malicious actor to perform attacks on domains by creating groups with names that match the unique...
CVE-2024-9633 Incorrect Ownership Assignment in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain,...
Exploit for Cross-site Scripting in Limesurvey
CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check...
CVE-2024-8042 Rapid7 Insight Platform Unauthorized Empty Group Creation
Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect...
GitLab Authenticated File Read
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GitLab Authenticated File Read', 'Description' = %q GitLab version 16.0 contains a directory traversal for arbitrary file read as the gitlab-www...
CVE-2022-48921 sched/fair: Fix fault in reweight_entity
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweightentity Syzbot found a GPF in reweightentity. This has been bisected to commit 4ef0c5c6b5ba "kernel/sched: Fix schedfork access an invalid schedtaskgroup" There is a race between schedpostfork and...
UBUNTU-CVE-2024-39496
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation and then trigger a use-after-free on the device that was just...
kernel: net/mlx5e: fix a double-free in arfs_create_groups
A double-free vulnerability was found in the arfscreategroups function in the Linux kernel's net/mlx5e driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior...
TeamCity Server < 2022.10.2 Multiple Vulnerabilities
According to its its self-reported version number, the version of JetBrains TeamCity running on the remote host is a version prior to 2022.10.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. CVE-2022-48342 ...
CVE-2023-26440
The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with access to a local or restricted network could perform arbitrary SQL queries. We have improved the inpu...
CVE-2022-48344
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process...
CVE-2022-48344
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process...
Cross site scripting
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process...
CVE-2022-48344
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process...
CVE-2022-48344
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process...
CVE-2022-48344
CVE-2022-48344 affects JetBrains TeamCity prior to 2022.10.2. The vulnerability is an XSS flaw in the group creation process. Impact is described as client-side security risk (XSS) with the stated CVE metrics. The Nessus/IDS references confirm versions before 2022.10.2 are vulnerable, and the rec...
JetBrains TeamCity 跨站脚本漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...
SUSE CVE-2021-39163
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where the vulnerable...
keycloak: Stored XSS in groups dropdown
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting XSS attack...
keycloak: Stored XSS in groups dropdown
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting XSS attack...