PT-2024-10173 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 17.4.5 GitLab CE/EE versions 17.5 through 17.5.3 GitLab CE/EE versions 17.6 through 17.6.1 Description: The issue is related to insufficient authorization procedures in the Public Project Handler component o...

CVE-2024-45282

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations...

CVE-2024-45282: Trusting HTTP Permission Methods on the Server Side

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations...

SAP S/4 HANA security vulnerabilities

SAP S/4 HANA is an intelligent, integrated ERP software for large enterprises from SAP. A security vulnerability exists in SAP S/4 HANA, which stems from a field in the "read only" state that can be modified via the MERGE method...

PT-2024-7173 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA affected versions not specified Description: The issue is related to the Manage Bank Statement Handler component of the SAP S/4HANA platform. It is caused by the lack of a mechanism to prevent unintended changes to resources when...

BIT-GITLAB-2023-3441 Exposure of Sensitive Information Due to Incompatible Policies in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

CVE-2023-3441

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

CVE-2023-3441 Exposure of Sensitive Information Due to Incompatible Policies in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

CVE-2023-3441

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

CVE-2023-3441

Removed by vendor...

Prototype Pollution

Overview org.webjars.npm:pace-js is an Automatically add a progress bar to your site. Affected versions of this package are vulnerable to Prototype Pollution via the extend function, which recursively copies key-value pairs from the source object without properly validating property names. An...

GitLab Enterprise Edition and Community Edition security vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition and Community Edition...

CVE-2023-3441: Exposure of Sensitive Information Due to Incompatible Policies

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches...

kernel: kyber: fix out of bounds access when preempted

In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted blkmqschedbiomerge gets the ctx and hctx for the current CPU and passes the hctx to -biomerge. kyberbiomerge then gets the ctx for the current CPU again and uses that to get the...

kernel: kyber: fix out of bounds access when preempted

In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted blkmqschedbiomerge gets the ctx and hctx for the current CPU and passes the hctx to -biomerge. kyberbiomerge then gets the ctx for the current CPU again and uses that to get the...

GPAC multimedia platform Heap Buffer Overflow DoS

The vulnerability of the gffilterpidmergepropertiesinternal function on the GPAC multimedia platform is related to the lack of memory release after the effective lifespan has ended. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2024-8235

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to the ext4 file system in the Linux kernel, where a vulnerability in the ext4 ext try to merge up function can cause a double release of a buffer, potentially leading to...