GitLab: [Repository Import] Open Redirect via "continue[to]" parameter

Hi, While experimenting with Repository Import functionality on a fresh GitLab 9.0 CE install, I noticed that the continueto parameter can be used to perform an Open Redirect through the inclusion of a double-slash prefix. Proof of Concept The following Proof of Concept URL enables a malicious...

Google Chrome Local File Access

The vulnerability of the Histogram component in Google Chrome browser is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to gain access to local files through a specially crafted HTML page...

Android DoS

The vulnerability of NVIDIA’s Android operating system video driver is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to cause service failures or otherwise affect the system...

Android DoS

The vulnerability of the Audioserver component of the libeffects sub-component in the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to cause service failures or otherwise affect the system...

CVE-2016-8977: Exposure of Sensitive Information to an Unauthorized Actor

IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system...

Flash Player Bypass Security

The vulnerability of the Flash Player software is related to the implementation of domain restriction rules. Exploiting this vulnerability allows a malicious actor to bypass the security mechanisms...

UBUNTU-CVE-2016-5287

A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox 49.0.2...

PT-2016-6343

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 49.0.2 Description A potentially exploitable use-after-free crash can occur during actor destruction with service workers. Recommendations For Firefox versions prior to 49.0.2, update to version 49.0.2 or later to...

Google Chrome DoS

The multiple vulnerabilities of the Google Chrome browser are related to errors in the code. Exploiting these vulnerabilities can allow a malicious actor to cause service failures or other adverse effects...

Google Chrome DoS

The multiple vulnerabilities of the Google Chrome browser are related to code errors. Exploiting these vulnerabilities can allow a malicious actor to cause service failures or other adverse effects...

Flash Player Information Disclosure

The vulnerabilities of the Flash Player and Flash Player for Linux are related to errors in the code. Exploiting these vulnerabilities can allow a malicious actor to compromise the integrity, accessibility, and confidentiality of information...

Safari Bypass Restrictions

The vulnerability of the WebKit Plug-ins component of the Safari browser exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to circumvent existing restrictions on sending requests through a specially crafted website...

Firefox DoS

The numerous vulnerabilities of the Firefox browser allow malicious actors to trigger service failures memory errors and unexpected application shutdowns or execute arbitrary code...

Java Platform Data Compromise

The vulnerability of the Java Platform software platform allows a malicious actor to compromise the confidentiality, integrity, and accessibility of data...

Java Platform Data Compromise

The vulnerability of the Java Platform software platform allows a malicious actor to compromise the confidentiality, integrity, and accessibility of data...

Java Platform Data Compromise

The vulnerability of the Java Platform software platform allows a malicious actor to compromise the integrity and accessibility of data by using the Tools component...

Debian GNU/Linux Data Compromise

The multiple vulnerabilities in the libuim-nox-dev package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information...

Adobe AIR Data Compromise

The vulnerability in Adobe AIR allows an attacker to execute arbitrary code or cause a service failure a memory-related error...

Jrockit Data Compromise

The vulnerability of the Jrockit platform, related to its subcomponents. Exploiting this vulnerability allows a malicious actor to compromise data confidentiality and integrity by using the Beans subcomponent...

Google Chrome DoS

A vulnerability in the Google Chrome browser, related to errors in Google V8 JavaScript. Exploiting this vulnerability allows a malicious actor to trigger a service failure or cause other adverse effects on the system...