GitLab gitlab-vscode-extension injection vulnerability

GitLab gitlab-vscode-extension is a VSCode code editor extension for Gitlab from GitLab USA. A security vulnerability exists in GitLab gitlab-vscode-extension version v2.2.0. An attacker can exploit the vulnerability to execute code on a user's system...

CVE-2020-13279

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

CVE-2020-13279

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

Code injection

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

CVE-2020-13279

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

CVE-2020-13279

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

CVE-2020-13279: Uncontrolled Search Path Element

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system...

PT-2020-13420

Name of the Vulnerable Software and Affected Versions gitlab-vscode-extension version 2.2.0 Description The issue allows for client-side code execution, enabling an attacker to execute code on a user's system. Recommendations For gitlab-vscode-extension version 2.2.0, update to a version that...

Microsoft VSCode Python Extension - Code Execution

Microsoft VSCode Python Extension - Code Execution VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folder...

Microsoft VSCode Python Extension - Code Execution

VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as...

CVE-2019-18213

XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF as well as SMB connection initiation that can lead to NetNTLM challenge/response captu...

CVE-2019-18213

XML Language Server (lsp4xml) prior to 0.9.1 used in Red Hat XML Language Support (vscode-xml) prior to 0.9.1 is affected. The vulnerability arises in extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java, where XXE can be triggered by a crafted XML document, leading to ...

CVE-2019-18212

XML Language Service (lsp4xml) in Red Hat XML Language Support (vscode-xml) versions before 0.9.1 is affected by a directory traversal vulnerability that allows a remote attacker to write to arbitrary files via XMLLanguageService.java. The issue is present in the XML Language Server implementatio...

CVE-2019-18212

XMLLanguageService.java in XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal...

CVE-2019-18213: Improper Restriction of XML External Entity Reference

XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF as well as SMB connection initiation that can lead to NetNTLM challenge/response captu...

CVE-2019-18212: Improper Limitation of a Pathname to a Restricted Directory

XMLLanguageService.java in XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal...

PT-2019-15279

Name of the Vulnerable Software and Affected Versions XML Language Server lsp4xml versions prior to 0.9.1 Red Hat XML Language Support vscode-xml versions prior to 0.9.1 Description The issue allows a remote attacker to write to arbitrary files via Directory Traversal, potentially leading to...

@cameronhunter/jest-json-schema (2.1.0), @limedocs/core (>=1.0.0-beta.1, <=1.0.0-beta.13) +3 more potentially affected by unknown CVE via url-relative (1.0.0)

url-relative NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on url-relative and may be impacted: - @cameronhunter/jest-json-schema 2.1.0 - @limedocs/core =1.0.0-beta.1, =0.9.0, =0.16.16 Source cves: unknown CVE Source advisory:...

Fedora 27 : fedpkg / rpkg (2017-9cac2b8b4a)

Update - Fixed chain-build - Remove hard dependency of bash-completion from fedpkg rpkg - Ignore TestModulesCli if openidc-client is unavailable cqi - Port mbs-build to rpkg mprahl - Add .vscode to .gitignore mprahl - Fix TestPatch.testrediff in order to run with old version of mock cqi - Allow t...