PT-2019-18965

Name of the Vulnerable Software and Affected Versions Online Store version 1.0 Description The issue concerns a Stored XSS in the user view.php file, where the adidas member user variable is not properly sanitized. Recommendations For Online Store version 1.0, ensure proper sanitization of the...

CVE-2019-15734

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

CVE-2019-15731

CVE-2019-15731 affects GitLab Community and Enterprise Edition 12.0–12.2.1. The issue allows non-members to comment on merge requests even when the repository is configured to permit comments only from project members. Root cause details are not explicitly provided in the connected documents beyo...

CVE-2019-15734: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

PT-2019-14356

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.6 through 12.2.1 Description An issue was discovered where commit titles and team member comments could become viewable to users who did not have permission to access these under very specific...

kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2019-32224)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...

CVE-2019-11544

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...

CVE-2019-11544

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...

Information disclosure

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...

CVE-2019-11544

Removed by vendor...

Denial Of Service (DoS)

fastjson is vulnerable to denial of service. An out-of-bounds exception in the chars array in the writeHex method of the SerializeWriter class allows an attacker to cause a denial of service condition using a malicious object with a large byte member...

GitLab Information Disclosure Vulnerability (CNVD-2019-30781)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2019-27693)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...

WordPress Ultimate Member plugin <= 2.0.53 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Ultimate Member plugin versions = 2.0.53. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.54...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2019-27689)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2019-27692)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2019-27697)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...

Ultimate Member Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...

WordPress Ultimate Member plugin cross-site scripting vulnerability (CNVD-2019-27688)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. A cross-site scripting vulnerability...