CVE-2024-3115

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat...

CVE-2024-3115

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat...

GitLab 16.0 < 16.11.5 / 17.0 < 17.0.3 / 17.1 < 17.1.1 (CVE-2024-3115)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to...

SAML SSO failure happens after renewing SAML certificate since CEM 24.4.0

When to use CEM as the SAML SSO Identity Provider IDP, following failure is reported in Splunk logs after renewing SAML certificate since CEM 24.4.0 "Exception occurred while reading the keyStore java.io.IOException: exception unwrapping private key - java.security.InvalidKeyException: pad block...

CVE-2024-3115 Exposure of Sensitive Information to an Unauthorized Actor in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat...

CVE-2024-3115 Exposure of Sensitive Information to an Unauthorized Actor in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat...

CVE-2024-4604

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Magarsus Consultancy SSO Single Sign On allows Manipulating Hidden Fields. This issue affects SSO Single Sign On: from 1.0 before 1.1...

CVE-2024-4228

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO Single Sign On allows SQL Injection. This issue...

CVE-2024-4604 Open Redirect in Magarsus Consultancy's SSO

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Magarsus Consultancy SSO Single Sign On allows Manipulating Hidden Fields. This issue affects SSO Single Sign On: from 1.0 before 1.1...

CVE-2024-4604

Magarsus Consultancy SSO (Single Sign On) contains an Open Redirect vulnerability in versions 1.0 through 1.0.x before 1.1, exposed by allowing manipulation of hidden fields that influence URL redirects. This is a URL redirection issue that could lead users to untrusted sites. Affected component:...

CVE-2024-4228 SQLi in Magarsus Consultancy's SSO

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO Single Sign On allows SQL Injection. This issue...

CVE-2024-4228

CVE-2024-4228 affects Magarsus Consultancy SSO (Single Sign On) versions 1.0 before 1.1. The vulnerability arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection. Impact is high: exposure of sensitive information, with insufficiently protected credent...

PT-2024-29831

Name of the Vulnerable Software and Affected Versions Magarsus Consultancy SSO versions 1.0 through 1.1 Description The issue is related to SQL Injection, which allows for the exposure of sensitive information to unauthorized actors and insufficiently protected credentials. This is due to the...

CVE-2024-4604: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Magarsus Consultancy SSO Single Sign On allows Manipulating Hidden Fields. This issue affects SSO Single Sign On: from 1.0 before 1.1...

PT-2024-31881

Name of the Vulnerable Software and Affected Versions Magarsus Consultancy SSO Single Sign On versions 1.0 through 1.1 Description The issue allows manipulation of hidden fields through URL redirection to untrusted sites, also known as an 'Open Redirect'. This can potentially be used to manipulat...

CVE-2024-4228: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO Single Sign On allows SQL Injection. This issue...

Gitlab -- Vulnerabilities

Gitlab reports: Run pipelines as any user Stored XSS injected in imported project's commit notes CSRF on GraphQL API IntrospectionQuery Remove search results from public projects with unauthorized repos Cross window forgery in user application OAuth flow Project maintainers can bypass group's mer...

Malicious code in @mosfe/sso-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3050 Malicious code in @mosfe/sso-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-49111

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...