152 matches found
PT-2026-26752
Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.1.0 Description The Caldav endpoint allows login using Basic Authentication, which bypasses the TOTP for accounts with 2FA enabled. This allows access to project information normally protected by 2FA, such as projec...
Vikunja has a 2FA Bypass via Caldav Basic Auth
The Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA if enabled, such as project name, description, etc...
GitLab 13.2 < 18.4.6 / 18.5 < 18.5.4 / 18.6 < 18.6.2 (CVE-2025-11247)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensiti...
CVE-2025-27550
IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server...
IBM Jazz Reporting Service（JRS） 安全漏洞
The IBM Jazz Reporting Service JRS is a ready-to-use reporting component developed by the American multinational company International Business Machines, Inc. IBM. This product includes functions such as report generation, data collection, and lifecycle querying. There is a security vulnerability...
CVE-2021-2258
Vulnerability in the Oracle Projects product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Projects...
CVE-2024-39888
A vulnerability has been identified in Mendix Encryption All versions = V10.0.0 V10.0.2. Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an...
Exposure of Sensitive Information Due to Incompatible Policies
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Due to Incompatible Policies due to insufficient access validation to private user projects. An attacker can gain unauthorized access to sensitive project information by directly accessing private proje...
BIT-GITLAB-2025-11247 Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...
EUVD-2025-202647
GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...
CVE-2025-11247 Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...
CVE-2025-64067
The Primakon Pi Portal version 1.0.18 is vulnerable to an authorization bypass in its API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records). The root cause is a lack of sufficient server-side validation to confirm that a requesting user i...
MAL-2025-69061 Malicious code in large-fuchsia-wasp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1062a47ed1f2271a0fdb57d02fb2c0e5cfaf128936e54cda914bcb6a251405 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-37521
MantisBT unauthorized disclosure of private project column configuration...
EUVD-2019-2634
Malware in sbrugna...
EUVD-2018-6349
Malware in sbrugna...
EUVD-2025-1730
Malicious code in bioql PyPI...
EUVD-2022-41747
Malicious code in bioql PyPI...