Prototype Pollution

Overview All versions of merge-recursive are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via proto causing the addition or modification of an existing property. Proof of concept: var merge =...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2019-26720)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Merge subcomponent of the MySQL Server component of Oracle MySQL, versions 5.6.41 and earlier, 5.7.23...

CVE-2018-3247: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Merge. Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

PT-2018-2402

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.6.41 and prior Oracle MySQL versions 5.7.23 and prior Oracle MySQL versions 8.0.12 and prior Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Server: Mer...

UBUNTU-CVE-2018-3247

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Merge. Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

Prototype Pollution in merge-options

All versions of merge-options are vulnerable to Prototype Pollution Recommendation Update to version 1.0.1 or greater...

box-node-sdk (>=1.16.0, <=1.16.1), homebridge-netatmo-schaloms (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2018-3752 via merge-options (1.0.0)

merge-options NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-options and may be impacted: - box-node-sdk =1.16.0, =0.2.3, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.13.1, =2.0.0, =2.0.1 Source cves: CVE-2018-3752 Source advisory:...

GHSA-QW93-45R3-P66P Prototype Pollution in merge-options

All versions of merge-options are vulnerable to Prototype Pollution Recommendation Update to version 1.0.1 or greater...

Gitlab -- multiple vulnerabilities

Gitlab reports: Merge request information disclosure Private project namespace information disclosure Gitlab Flavored Markdown API information disclosure...

Cross site scripting

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

CVE-2018-16050

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

CVE-2018-16050

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

CVE-2018-16050

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

CVE-2018-16050

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

CVE-2018-16050

Removed by vendor...

CVE-2018-16050: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View...

PT-2018-13389

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.x through 11.1.4 GitLab Community and Enterprise Edition versions 11.2.x through 11.2.1 Description An issue was discovered in GitLab, which results in Persistent XSS in the Merge Request...

FreeBSD : Gitlab -- multiple vulnerabilities (065b3b72-c5ab-11e8-9ae2-001b217b3468)

Gitlab reports : SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Prototype Pollution

merge is vulnerable to prototype pollution. Properties of the Object prototype can be added or modified via JSON.parse, causing a denial of service condition or possibly remote code execution depending on the application...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...