UBUNTU-CVE-2024-1211

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAut...

PT-2025-4393 · Uaa · Uaa

Name of the Vulnerable Software and Affected Versions: UAA affected versions not specified Description: The issue concerns a UAA configured with multiple identity zones, where session information is not properly validated across those zones. This allows a user authenticated against a corporate ID...

CVE-2024-1211 Cross-Site Request Forgery (CSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAut...

CVE-2024-1211

Removed by vendor...

CVE-2024-1211 Cross-Site Request Forgery (CSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAut...

CVE-2024-54461

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

CVE-2024-54462

CVE-2024-54462 concerns the Flutter image_picker_android component. The issue arises from unsanitized filenames created by image_picker, which can be exploited by a malicious document provider to have a user select an image file from that provider and potentially override internal files in the ap...

CVE-2024-54461

CVE-2024-54461 affects file_selector_android (Flutter). The issue is unsanitized/cleanup-lacking filenames in file_selector’s file choosing, allowing a malicious document provider to select a file and potentially overwrite internal files in the app cache. A fix exists in 0.5.1+12; update to the l...

CVE-2024-54461 Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

CVE-2024-54461 Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites

The file names constructed within fileselector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could...

PT-2025-3025 · Unknown · File Selector +1

Name of the Vulnerable Software and Affected Versions: file selector versions prior to 0.5.1+12 file selector android versions prior to 0.5.1+12 Description: The file names constructed within file selector are missing sanitization checks, leaving them vulnerable to malicious document providers...

CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3

CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3. A patched version of the package is available...

CVE-2023-40132

In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

CVE-2023-40132

CVE-2023-40132 affects Google Android through RingtoneManager.setActualDefaultRingtoneUri. The vulnerability arises from a missing permission check when accessing content providers, allowing a local escalation of privilege by bypassing read permissions. Impact is described as local privilege esca...

Google Android 安全漏洞

Google Android is a Linux-based operating system from the American company Google. Google Android suffers from an elevation of privilege vulnerability that stems from a lack of privilege checking and can be exploited to bypass the read permission of a content provider. An attacker can exploit the...

AZL-78537 CVE-2024-13176 affecting package openssl-fips-provider 3.1.2-2

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...

Malicious code in @moneyguide-devkit/style-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d41e363cb9b67e73c6cfe2f5b71641d9289a57d80051c4e3e67b22db36574d8 The OpenSSF Package Analysis project identified '@moneyguide-devkit/style-provider' @ 1.0.1 npm as malicious. It is considered malicious because...

CVE-2018-9375

In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9375

In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...