CVE-2019-15580

An information exposure vulnerability exists in gitlab.com v12.3.2, v12.2.6, and v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted...

CVE-2019-5487

Removed by vendor...

CVE-2019-5487

The CVE-2019-5487 entry concerns an improper access control in GitLab Enterprise Edition (GitLab EE) prior to v12.3.3, v12.2.7, and v12.1.13. The vulnerability arises in the group search feature when used with Elasticsearch, allowing leakage of private data (private code, merge requests, commits)...

CVE-2019-15580

Removed by vendor...

CVE-2019-15591

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...

CVE-2019-15591: Improper Access Control

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...

PT-2019-14297

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 12.3.3 Description An issue exists that allows an attacker to bypass access controls and obtain container and dependency scanning reports through the merge request widget, even when public pipelines are disabled...

PT-2019-14294

Name of the Vulnerable Software and Affected Versions gitlab versions prior to 12.3.2 gitlab versions prior to 12.2.6 gitlab versions prior to 12.1.10 Description An information exposure issue exists when using the blocking merge request feature. It allows an unauthenticated user to see the head...

ffmpeg:ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer: Index-out-of-bounds in cbs_av1_read_film_grain_params

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5747424845103104 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFAV1FRAMEMERGEfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

Prototype Pollution

angularjs is vulnerable to prototype pollution. An attacker is able to add or modify properties of the Object.prototype by using a malicious proto object in the merge function, resulting in possible execution of arbitrary code...

AngularJS Input Validation Error Vulnerability

AngularJS is a TypeScript-based open source web application framework. An input validation error vulnerability exists in AngularJS versions prior to 1.7.9, which can be exploited by an attacker via the proto payload to trick the merge function into adding or modifying properties of Object.prototy...

CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

DEBIAN-CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

Code injection

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

UBUNTU-CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2019-10768

In AngularJS before 1.7.9 the function "merge" could be tricked into adding or modifying properties of "Object.prototype" using a "proto" payload...

CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2019-10768

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...

CVE-2019-10768: Improperly Controlled Modification of Object Prototype Attributes

In AngularJS before 1.7.9 the function merge could be tricked into adding or modifying properties of Object.prototype using a proto payload...