PT-2019-9865

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue is related to an insecure direct object reference, allowing unauthorized users to publish draft merge request comments of other users...

GitLab Information Disclosure Vulnerability (CNVD-2020-22024)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

FreeBSD : Gitlab -- Multiple Vulnerabilities (4ea507d1-9da8-11e9-a759-001b217b3468)

Gitlab reports : Ability to Write a Note to a Private Snippet Recent Pipeline Information Disclosed to Unauthorised Users Resource Exhaustion Attack Error Caused by Encoded Characters in Comments Authorization Issues in GraphQL Number of Merge Requests was Accessible Enabling One of the Service...

Windows Defender Firewall: Private Profile: Apply local firewall rules

The policy determines whether the local firewall rules are merged with GP settings when connected to a private network. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Ability to Write a Note to a Private Snippet Recent Pipeline Information Disclosed to Unauthorised Users Resource Exhaustion Attack Error Caused by Encoded Characters in Comments Authorization Issues in GraphQL Number of Merge Requests was Accessible Enabling One of the Service...

CVE-2019-7259

Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure...

`boxfnonce` obsolete with release of Rust 1.35.0

This commit marks the boxfnonce crate as obsolete and the GitHub repo has since been archived. The functionality of boxfnonce has been added to Rust since 1.35.0. Use Box...

@admui/grid (>=0.1.10, <=0.3.1), @astro-my/design-systems (>=0.3.14, <=0.4.42) +157 more potentially affected by CVE-2019-10744 via lodash-es (>=4.0.0, <=4.17.11)

lodash-es NPM version =4.0.0, =0.1.10, =0.3.14, =0.4.63, =0.1.1, =0.1.1, =0.3.2-a, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.5.24 and more Source cves: CVE-2019-10744 Source advisory: SNYK:JS-LODASHES-2434290...

Prototype Pollution

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor...

GHSA-F7QW-5PVG-MMWP Prototype Pollution in lutils-merge

All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

Prototype Pollution in lutils-merge

All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

anjiayi-elf (>=1.0.0, <=1.0.9), anjiayi-exp (>=1.0.0, <=1.2.6) +5 more potentially affected by unknown CVE via lutils-merge (>=0.1.4, <=0.2.6)

lutils-merge NPM version =0.1.4, =1.0.0, =1.0.0, =1.0.0, =0.0.1-alpha, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F7QW-5PVG-MMWP...

PT-2019-20041

Name of the Vulnerable Software and Affected Versions lutils-merge versions all Description The issue concerns Prototype Pollution, where the merge function fails to prevent user input from altering an Object's prototype. This allows attackers to modify or override properties of all objects in th...

GHSA-GM9G-2G8V-FVXJ Prototype Pollution in upmerge

All versions of upmerge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

PT-2019-20047

Name of the Vulnerable Software and Affected Versions upmerge versions affected versions not specified Description The issue concerns a Prototype Pollution problem. The merge function fails to prevent user input from altering an Object's prototype, allowing attackers to modify or override...

Prototype Pollution

Overview All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with...

Authorization

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...