PT-2023-28979 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.8 through 16.1.4 GitLab CE/EE versions 16.2 through 16.2.4 GitLab CE/EE versions 16.3 through 16.3.0 Description: An issue has been discovered that allows a malicious Maintainer to leak the sentry token under specific...

YSoft SAFEQ 6 安全漏洞

YSoft SAFEQ 6 is an enterprise print management suite solution platform from the Czech company YSoft. A security vulnerability exists in YSoft SAFEQ 6 Server versions prior to 6.0.82, which stems from the fact that when changing the URL of an LDAP server configuration from LDAPS to LDAP, the syst...

UBUNTU-CVE-2022-4054

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an...

systemd security and bug fix update

239-68.0.2.1 - Backport upstream pstore dmesg fix Orabug: 34850699 - Standardize ioctl BTRFSIOCQGROUPCREATE check and return -ENOTCONN, if quota is not enabled Orabug: 34694253 - Disable unprivileged BPF by default Orabug: 32870980 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev...

UBUNTU-CVE-2022-4365

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error...

PT-2023-14273 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.8 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2 Description: A malicious Maintainer can exploit an issue in GitLab CE/EE to leak the sentry token. This is achieved ...

CVE-2021-37331

Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL...

systemd security, bug fix, and enhancement update

239-40.0.1 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev rules: fix memory hot add and remove Orabug: 31310273 - fix to enable systemd-pstore.service Orabug: 30951066 - journal: change support URL shown in the catalog entries Orabug: 30853009 - fix to generate...

PYSEC-2019-65

When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0...

Debian: Security Advisory (DLA-1115)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HackerOne: Websites opened from reports can change url of report page

This issue is similar to 124889, but it is only exploitable via MS Edge or Internet Explorer 11 Proof Of Concept: Clicking on a link set to "http://d214mfsab.org/same.html" including this one will change the still-open report page to http://example.com. This works on current versions of MS Edge a...

SF Web Page inaccessible after changing Base URL

- Once the SF is configured, there might be a need to change the Base URL. However, the SF page becomes inaccessible and throws below error - You might also get "Cannot complete your request" on this page...

CVE-2014-9508

TYPO3 Open Redirect/Link Spoofing vulnerability CVE-2014-9508 affects the frontend rendering component. Affected: TYPO3 4.5.x before 4.5.39, 4.6.x–6.2.x before 6.2.9, and 7.x before 7.0.2. Condition: config.prefixLocalAnchors enabled with an anchor-only homepage; attacker can modify anchor-only l...

Localize: Full Path Disclosure (2)

During the import of an XML file,I edited the "file" to "url" for importing XML's through URL.So it became: html And then I tried to import a random XML file.I tried with this: http://www.swarthmore.edu/libraries.xml It was not a valid XML file.And after the importing it showed the following erro...

CVE-2013-0299

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the timezone for the user via the lat and lng parameters to...

firefox security update

firefox: 3.0.19-1.0.1.el55 - Update firstrun and homepage URLs in specfile - Added patch oracle-firefox-branding.patch - Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html and removed the corresponding RedHat ones 3.0.19-1 - Update to 3.0.19 xulrunner: 1.9.0.19-1.0.1.el55...

Mandriva Update for foo2zjs MDKA-2007:121 (foo2zjs)

Check for the Version of foo2zjs OpenVAS Vulnerability Test Mandriva Update for foo2zjs MDKA-2007:121 foo2zjs Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Mandriva Update for foo2zjs MDKA-2007:121 (foo2zjs)

Check for the Version of foo2zjs OpenVAS Vulnerability Test Mandriva Update for foo2zjs MDKA-2007:121 foo2zjs Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Php-nuke exploit...

Hi people... This went public today... there are a bug in the banner section of php-nuke http://www.phpnuke.org which is web engine... the problem is you can change the url banners form anywhere, to anywhere example, to change the url of the first banner yo should enter un your browser...

PHP-Nuke 1.02.53.04.x - Remote Ad Banner URL Change

PHP-Nuke 1.02.53.04.x - Remote Ad Banner URL Change source: https://www.securityfocus.com/bid/2544/info PHP-Nuke is a website creation/maintainence tool written in PHP3. A PHP-Nuke feature supporting cycling ad banners is subject to interference from a remote user. A querystring can be submitted ...