PT-2020-22254

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is reported, which can cause a crash. The crash involves the iri unescape inline, wget iri parse, and add mirror function...

GitLab: An attacker can run pipeline jobs as arbitrary user

Summary An attacker can run arbitrary pipeline jobs as a victim user. This means the attacker can access the user private repositories, member only repositories, registry, etc... by using the victim CIJOBTOKEN token. This is only my recent research and I wanted to report it as soon as possible. I...

icon-icons.com Cross Site Scripting vulnerability OBB-1180609

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| icon-icons.com ---|--- Open Bug Bounty...

All Vulnerabilities for goea.louisiana.gov Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| goea.louisiana.gov ---|--- Open Bug...

dochkisinochki.ru Cross Site Scripting vulnerability OBB-1157036

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| dochkisinochki.ru ---|--- Open Bug Boun...

FreeBSD : Gitlab -- Multiple Vulnerabilities (e8483115-8b8e-11ea-bdcf-001b217b3468)

Gitlab reports : Path Traversal in NuGet Package Registry Workhorse Bypass Leads to File Disclosure OAuth Application Client Secrets Revealed Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes Code Owners Protection Not Enforced from Web UI Repositor...

CVE-2020-12277

Removed by vendor...

CVE-2020-12277: Incorrect Default Permissions

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

All Vulnerabilities for inn.co.il Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| inn.co.il ---|--- Open Bug Bounty...

adavr.dglab.gov.pt Open Redirect vulnerability OBB-1145387

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| adavr.dglab.gov.pt ---|--- Open Bug...

cronista.com Cross Site Scripting vulnerability OBB-1144485

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| cronista.com ---|--- Open Bug Bounty...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.7.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

GitLab: Initial mirror user can be assigned by other user even if the mirror was removed

Summary Even if the mirror was removed, project.mirroruser still will be persisted. So any maintainer can create "pull" mirror with initial mirror user: safemirrorparams.rb def validmirroruser?mirrorparams return true unless mirrorparams:mirroruserid.present?...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.6.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

sprl.in Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1074969 Security Researcher geeknik Helped patch 8675 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting sprl.in website and its...

All Vulnerabilities for bazos.cz Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| bazos.cz ---|--- Open Bug Bounty...

rixot.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1071382 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Security Bulletin: IBM Db2 Mirror for i is affected by CVE-2019-4536

Summary IBM Db2 Mirror for i configurations may be subject to this security vulnerability. A PTF for IBM i 7.4 and remediation steps are available. Vulnerability Details CVEID: CVE-2019-4536 DESCRIPTION: IBM i 7.4 users who have done a Restore User Profile RSTUSRPRF on a system which has been...

new.job.ws Cross Site Scripting vulnerability OBB-1024040

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| new.job.ws ---|--- Open Bug Bounty...

All Vulnerabilities for faks.mitja.ws Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| faks.mitja.ws ---|--- Open Bug Bounty...