Code injection

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leav...

CVE-2018-20500

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leav...

PT-2019-10093

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 9.4 through 11.4.12 GitLab Community and Enterprise Edition versions 11.5.x through 11.5.5 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.0 Description: An insecure...

CVE-2018-20500: Incorrect Permission Assignment for Critical Resource

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leav...

NULL Pointer Dereference

tcmu-runner is vulnerable to NULL pointer dereference. The vulnerability exists in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call UnregisterHandler method with non-existing tcmu handler as paramater to...

Privilege Escalation

tcmu-runner is vulnerable to privilege escalation. The vulnerability exists in implementation of the CheckConfig method in handlerqcow.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could use this flaw to leak arbitrary file names which might not be...

Denial Of Service (DoS)

tcmu-runner is vulnerable to NULL pointer dereference. The vulnerability exists in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call the UnregisterHandler method with the name of a handler loaded internally in...

FreeBSD : Gitlab -- Group Runner Registration Token Exposure (a0602fa0-5c1c-11e9-abd6-001b217b3468)

Gitlab reports : Group Runner Registration Token Exposure C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

Gitlab -- Group Runner Registration Token Exposure

Gitlab reports: Group Runner Registration Token Exposure...

Gitlab -- Vulnerability

Gitlab reports: Project Runner Token Exposed Through Issues Quick Actions...

GitLab: JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions

The Quick Actions interpreter allows an attacker to reference a Project it does not have access to. The model attributes are then being serialized and returned to the user, which results in the Runner token both encrypted and unencrypted being returned to the user. This vulnerability is currently...

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...

Denial Of Service (DoS)

tcmu-runner is vulnerable to denial of service. A flaw was found in the implementation of CheckConfig method in handlerglfs.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could send a specially crafted string to CheckConfig method resulting in various kin...

Go Ethereum Denial of Service Vulnerability

Go Ethereum aka geth is an open source implementation of the Ether protocol written in the Go language. A security vulnerability exists in the cmd/evm/runner.go file in Go Ethereum version 1.8.17. An attacker can exploit the vulnerability with the help of specially crafted bytecode to cause a...

PT-2018-14845

Name of the Vulnerable Software and Affected Versions Go Ethereum aka geth version 1.8.17 Description The issue allows attackers to cause a denial of service SEGV via crafted bytecode. This is related to the cmd/evm/runner.go file in Go Ethereum. The estimated number of potentially affected devic...

com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0)

org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...

Remote code execution

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

CVE-2018-1000146

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

CVE-2018-1000146

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...