1005 matches found
CVE-2020-36233
The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory...
Atlassian Bitbucket Server and Data Center Security Vulnerability
Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution is able to manage and review code with features such as diff view, JIRA integration, and build integration. A security vulnerability exists in Atlassian Bitbucket Server and Data Center. The...
Atlassian Bitbucket on Windows is vulnerable to privilege escalation due to weak ACLs
Overview Atlassian Bitbucket on Windows fails to properly set ACLs, which can allow an unprivileged Windows user to run arbitrary code with SYSTEM privileges. Description The Atlassian Bitbucket Windows installer fails to set a secure access-control list ACL on the default installation directory,...
Privilege Escalation Vulnerability in Atlassian Bitbucket on Windows - CVE-2020-36233
h3. Issue Summary Atlassian Bitbucket on Windows fails to properly set ACLs on its installation directory. Because Bitbucket installs High-privileged services, this allows for multiple privilege escalation vulnerability possibilities. h3. Affected Versions The following versions are only affected...
Privilege Escalation Vulnerability in Atlassian Bitbucket on Windows - CVE-2020-36233
h3. Issue Summary Atlassian Bitbucket on Windows fails to properly set ACLs on its installation directory. Because Bitbucket installs High-privileged services, this allows for multiple privilege escalation vulnerability possibilities. h3. Affected Versions The following versions are only affected...
CVE-2021-20180
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...
Red Hat Ansible Log Information Disclosure Vulnerability
Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to distribute, manage, and organize computer systems. A log information disclosure vulnerability exists in Red Hat Ansible collection, which stems from the fact that the program...
PT-2021-8094
Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A flaw was found in the Ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket pipeline variable modul...
Bitbucket Keysight SQL Injection Vulnerability
Bitbucket Keysight is a database connection plugin available for Atlassian products from the Bitbucket organization. A SQL injection vulnerability exists in the Keysight Database Connector plugin before 1.5.0, which originates from a malicious user being able to bypass access control and submit...
Keysight Database Connector plugin code injection vulnerability
Bitbucket Keysight is a database connector plugin available for Atlassian products from the Bitbucket organization. A security vulnerability exists in the Keysight Database Connector plugin before 1.5.0, which originates from a malicious user being able to insert arbitrary JavaScript into saved...
Digitally Signed Bandook Trojan Reemerges in Global Spy Campaign
A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook. According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal”...
Digitally Signed Bandook Malware Once Again Targets Multiple Sectors
A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan. Check Point Research called out hackers affiliated with a group named Dark Caracal in a...
User has access to project and repository after global permission has been removed
h3. Problem User has access to project and repository after global permission has been removed. Conversely, a user in this affected state will be greeted with "permission denied" even after the global permission has been re-granted to the user. h3. Environment - Tested on 7.5 and 7.3 h3. Steps to...
CVE-2020-13330
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature...
CVE-2020-13330
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature...
CVE-2020-13330
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature...
Design/Logic Flaw
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature...
UBUNTU-CVE-2020-13330
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature...
GitLab Cross-Site Scripting Vulnerability (CNVD-2020-57835)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions prior ...
CVE-2020-13330
GitLab before version 12.10.13 is affected by a stored XSS in the Bitbucket project import feature. Root cause: input handling flaw leading to stored XSS. Impact per sources is MEDIUM (CVSS v3.1 base score 5.4); NVD lists 3.5 (LOW) in CVSS2. Remediation: upgrade to GitLab 12.10.13 or newer (or ap...