CVE-2021-39888

In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates...

PT-2021-22734 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.10 through 14.1.7 GitLab EE versions 14.2 through 14.2.5 GitLab EE versions 14.3 through 14.3.1 Description: A specific API endpoint may reveal details about a private group and other sensitive information inside issue a...

UBUNTU-CVE-2021-39885

A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious...

CVE-2021-39885

A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious...

CVE-2021-39885

A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious...

CVE-2021-39885

Removed by vendor...

PT-2021-22731 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab EE versions 13.7 through 14.1.7 Gitlab EE versions 14.2 through 14.2.5 Gitlab EE versions 14.3 through 14.3.1 Description: A Stored XSS issue in the merge request creation page allows an attacker to execute arbitrary JavaScript code on...

Prototype Pollution

Overview @brikcss/merge is an Utility to perform a deep merge of a list of objects or arrays. Affected versions of this package are vulnerable to Prototype Pollution via the Merge function. PoC // PoC.js var merge = require"@brikcss/merge" var obj = var maliciouspayload = '"proto":"polluted":"Yes...

@brikcss/rollup-config-generator (>=0.0.15 <=0.0.16), @brikcss/stakcss (>=0.0.0 <=0.9.1) +9 more potentially affected by CVE-2026-6594 via @brikcss/merge (>=1.0.7 <=1.3.0)

@brikcss/merge NPM version =1.0.7, =0.0.15, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.2.0, =0.10.0 Source cves: CVE-2026-6594 Source advisory: SNYK:JS-BRIKCSSMERGE-1727594...

react-here-map-interactive (>=0.0.1 <=0.9.2) potentially affected by CVE-2021-23700 via merge-deep2 (=3.0.6)

merge-deep2 NPM version =3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on merge-deep2 and may be impacted: - react-here-map-interactive =0.0.1, =0.9.2 Source cves: CVE-2021-23700 Source advisory: SNYK:JS-MERGEDEEP2-1727593...

Prototype Pollution

Overview merge-deep2 is a Recursively merge values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function. PoC // Create the following PoC file: // PoC.js var mergeDeep2 = require"merge-deep2" var obj = var maliciouspayload =...

GitLab EE 跨站脚本漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab EE...

PVS 1912:Unable to merge vdisk "vDisk versions are not up to date on all Servers that access this vDisk. Update all "

Unable to merge the old versions of vdisk. Error message when we attempt merge: "vDisk versions are not up to date on all Servers that access this vDisk. Update all Servers with the lastest versions of the vDisk files"...

GHSA-FHV8-FX5F-7FXF Prototype Pollution in the merge and clone helper methods

Impact Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly. Patches It has been patched in...

Memory Safety Issue when using patch or merge on state and assign the result back to state

Impact This vulnerability is a memory safety Issue when using patch or merge on state and assign the result back to state. In this case affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be access...

Prototype Pollution

zrender is vulnerable to prototype pollution. An attacker is able to inject malicious property using merge and clone helper methods in the src/core/util.ts causing prototype pollution via proto...

Design/Logic Flaw

Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using patch or merge on state and assign the result back to state. In this case, affected versions of Tremor and the tremor-script...

CVE-2021-39228

CVE-2021-39228 affects Tremor 0.7.2–0.11.6, including the tremor-script crate. The issue is a memory-safety bug that occurs when using tremor-script’s patch or merge on the state and assigning the result back to state; the optimizer could modify the target in place, leaving references to memory t...

Tremor 资源管理错误漏洞

Tremor is an open source event processing system for unstructured data. A resource management error vulnerability exists in Tremor Tremor-runtime, which arises when the product causes access to freed memory when using patch or merge on a state and assigning the result back to the state state. The...

PT-2021-22477 · Apache · Apache Echarts

Name of the Vulnerable Software and Affected Versions: ZRender versions prior to 5.2.1 Apache ECharts versions prior to 5.2.1 Description: The issue results in prototype pollution when using merge and clone helper methods in the src/core/util.ts module. It affects Apache ECharts, which uses and...