GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 16.2 through before 17.7.6, 17.8 through before 17.8.4, and 17.9 through before 17.9.1, which stems from the ability of a Guest user ...

Linux Distros Unpatched Vulnerability : CVE-2011-1750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple heap-based buffer overflows in the virtio-blk driver hw/virtio-blk.c in qemu-kvm 0.14.0 allow local guest users to cause a denial of service guest cras...

Gitlab -- Vulnerabilities

Gitlab reports: XSS in k8s proxy endpoint XSS Maven Dependency Proxy HTML injection leads to XSS on self hosted instances Improper Authorisation Check Allows Guest User to Read Security Policy Planner role can read code review analytics in private projects...

PT-2025-9085 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab-EE versions 16.2 through 17.7.5 GitLab-EE versions 17.8 through 17.8.3 GitLab-EE versions 17.9 through 17.9.0 Description: A vulnerability in GitLab-EE allows a Guest user to read Security policy YAML. Recommendations: For GitLab-EE...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that originates from a request to SolrSearch by any guest user that can cause remote code execution...

CVE-2024-34520

An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls...

CVE-2024-24772

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

CVE-2024-34520

An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls...

CVE-2024-34520

An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R10240, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls...

CVE-2024-34520

The CVE-2024-34520 issue affects the Mavenir SCE Application Provisioning Portal (PORTAL-LBS-R_1_0_24_0). The vulnerability is an authorization bypass in which an authenticated guest can perform unauthorized administrative actions (e.g., access to the create/add user functionality) by bypassing c...

CVE-2024-7627

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated...

CVE-2024-22186

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-48245

CVE-2024-48245 concerns Vehicle Management System (versions 1.0–1.3) with a SQL Injection via vulnerable POST parameters in administrative actions. A guest user can exploit parameters such as Booking ID , Action Name , and Payment Confirmation ID located in /newvehicle.php and /newdriver.php to e...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

BIT-MATTERMOST-2024-43780

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.0, 9.8.x = 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel...

CVE-2024-5005 Incorrect Provision of Specified Functionality in GitLab

An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API...

CentOS 7 : qemu-kvm-ma (RHSA-2020:4078)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4078 advisory. - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets fro...

CVE-2024-8354

A flaw was found in QEMU. An assertion failure was present in the usbepget function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition...