CVE-2024-7296 Incorrect Authorization in GitLab

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users...

CVE-2024-7296

GitLab EE contains CVE-2024-7296: affected releases are 16.5 up to 17.7.7, 17.8 up to 17.8.5, and 17.9 up to 17.9.2. A user with a custom permission could approve pending membership requests beyond the configured cap, potentially granting access beyond allowed users. This is described across mult...

CVE-2025-1969 Request approval spoofing in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center

Improper request input validation in Temporary Elevated Access Management TEAM for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

Amazon AWS Temporary Elevated Access Management 访问控制错误漏洞

Amazon AWS Temporary Elevated Access Management Amazon AWS TEAM is an open source privilege management solution integrated with AWS IAM Identity Center from Amazon.com, Inc. It is used to manage and monitor AWS Temporarily Elevated Access at scale. A security vulnerability exists in Amazon AWS...

WordPress plugin MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. The WordPress plugin MarketKing - Ultimate WooCommerce Multivendor Marketplace...

Doppler Launches ‘Change Requests’ to Strengthen Secrets Management Security with Audited Approvals

San Francisco, United States / California, 3rd October 2024, CyberNewsWire...

Master Your PCI DSS v4 Compliance with Innovative Smart Approvals

The PCI DSS landscape is evolving rapidly. With the Q1 2025 deadline looming ever larger, businesses are scrambling to meet the stringent new requirements of PCI DSS v4.0. Two sections in particular, 6.4.3 and 11.6.1, are troublesome as they demand that organizations rigorously monitor and manage...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab that stems from allowing bypassing...

The vulnerability of the Approvals component of the Oracle Purchasing software, which handles purchase orders, allows a hacker to gain read, modify, add, or delete access to data.

The vulnerability of the Approvals component in the Oracle Purchasing software for processing purchase orders involves insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

CVE-2024-21132

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: Approvals. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks...

UBUNTU-CVE-2024-0410

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict...

Authorization

An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals...

PT-2023-30288 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 14.7 through 16.3.5 GitLab EE versions 16.4 through 16.4.1 GitLab EE versions 16.5 through 16.5.0 Description: An authorization issue affecting GitLab EE allowed a user to run jobs in protected environments, bypassing any...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from allowing users to...

Zero address Salt used in Creating delegate contract

Lines of code Vulnerability details Impact A zero-valued salt used, means an attacker can predict the contract address of a new delegate, this can lead an attacker to create the ERC20ProxyDelegator on behalf of the user, this is to allow for max access to the tokens to be transfered Proof of...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to access control deficiencies, allows a violator to bypass code owners’ approval by modifying the master branch.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass code owners’ approvals by modifying the master branch...

The vulnerability of the Merge request approvals function in the software platform based on Git for collaborative code development on GitLab allows a violator to gain unauthorized access to protected information.

The vulnerability of the Merge request approvals function in a Git-based software platform for collaborative code development on GitLab is related to the provision of direct links to objects. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Design/Logic Flaw

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals"...