11408 matches found
PT-2020-12444 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.11 through 12.9.1 Description: The issue allows blocked users to pull and push Docker images. This is a significant concern as it bypasses the intended access restrictions for blocked users. Recommendations: For GitLab...
GitLab: XSS on Issue reference numbers
Dear team, I found an XSS that occurs when users move mouse over reference numbers of issues. This XSS occurs on Firefox. It does not occurs on Webkit-based ones such as Safari, Chrome. I haven't tested on Edge. It can be also occured in older browsers due to svg4everybody and...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: Arbitrary File Read when Moving an Issue Path Traversal in NPM Package Registry SSRF on Project Import External Users Can Create Personal Snippet Triggers Decription Can be Updated by Other Maintainers in Project Information Disclosure on Confidential Issues Moved to Private...
Samsung Mobile Device Information Disclosure Vulnerability (CNVD-2020-32873)
Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An information disclosure vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to bypass the Secure Folder feature and view images...
CVE-2019-20580
An issue was discovered on Samsung mobile devices with P9.0 software. The Motion photo player allows attackers to bypass the Secure Folder feature to view images. The Samsung ID is SVE-2019-14653 August 2019...
CVE-2019-20580
This CVE concerns Samsung mobile devices running P(9.0). The Motion photo player is able to bypass the Secure Folder feature to view images, constituting an information disclosure vulnerability. Affected software/hardware: Samsung mobile devices with P(9.0). Vulnerable component: Motion photo pla...
PlayStation: SSRF chained to hit internal host leading to another SSRF which allows to read internal images.
Report Summary: We found an SSRF at https://image.api.np.km.playstation.net/ Vulnerable endpoints: /images , /dis/images. using image GET parameter. Description This endpoint allows us to fetch a remote image over HTTP protocol using the image GET parameter and convert them to the desired format...
GLSA-202003-38 : PECL Imagick: Arbitrary code execution
The remote host is affected by the vulnerability described in GLSA-202003-38 PECL Imagick: Arbitrary code execution An out-of-bounds write vulnerability was discovered in the Imagick PHP extension. Impact : A remote attacker, able to upload specially crafted images which will get processed by...
InstaSave - Python Script To Download Images, Videos & Profile Pictures From Instagram
InstaSave is a python script to download images, videos & profile pictures from Instagram without any API access. Features Download Instagram Photos Download Instagram Videos Download Instagram Profile Pictures Git Installation clone the repo $ git clone...
CVE-2020-10648
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...
CVE-2020-10648
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...
CVE-2020-10648
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...
PT-2020-12267 · Denx +2 · Das U-Boot +2
Name of the Vulnerable Software and Affected Versions: Das U-Boot versions through 2020.01 Description: The issue allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...
python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
A flaw was discovered in python-pillow does where it does not properly restrict operations within the bounds of a memory buffer when decoding PCX images. An application that uses python-pillow to decode untrusted images may be vulnerable to this flaw, which can allow an attacker to crash the...
SUSE SLES15 Security Update : cni, cni-plugins, conmon, fuse-overlayfs, podman (SUSE-SU-2020:0697-1)
This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues : podman was updated to 1.8.0 : CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 The...
Code injection
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajaxcalls.php file in the saveimg action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF...
CVE-2020-10087
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user...
CVE-2020-10087
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user...