4543 matches found
CVE-2024-2818: Allocation of Resources Without Limits or Throttling
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels...
CVE-2023-6371: Improper Neutralization of Input During Web Page Generation
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf...
GitLab CE/EE Password Reset
Exploit Title: GitLab CE/EE 16.7.2 - Password Reset Exploit Author: Sebastian Kriesten 0xB455 Twitter: https://twitter.com/0xB455 Date: 2024-01-12 Vendor Homepage: gitlab.com Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/...
Huawei EulerOS: Security Advisory for proftpd (EulerOS-SA-2024-1345)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-26521
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...
Design/Logic Flaw
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...
CVE-2024-26521
CE Phoenix (e-commerce software), version v1.0.8.20 and earlier , contains an HTML Injection vulnerability in the english.php component. The root cause is the insufficient neutralization of special characters , which allows a remote attacker to use a crafted payload to execute arbitrary code , es...
CVE-2024-26521
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...
CE Phoenix Cart Security Vulnerability
CE Phoenix Cart is a free, open source e-commerce shopping cart software from CE Phoenix Cart Open Source. A security vulnerability exists in CE Phoenix Cart v1.0.8.20 and earlier versions, which stems from the presence of an HTML injection vulnerability. The vulnerability can be exploited by an...
CVE-2024-26521: Improper Neutralization of Input During Web Page Generation
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...
CVE-2024-26521
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...
CVE-2023-32264
CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code and execute it on the client's computer...
PT-2024-12309 · Opentext · Opentext Documentum D2
Name of the Vulnerable Software and Affected Versions: OpenText Documentum D2 versions 16.5.1 through CE 23.2 Description: The issue allows the upload of arbitrary code, which can then be executed on the client's computer. This could potentially lead to malicious activities. Recommendations: For...
OpenText Documentum D2 Security Vulnerability
OpenText Documentum D2 is a component of an Enterprise Content Management ECM solution from OpenText. A security vulnerability exists in OpenText Documentum D2 versions 16.5.1 through CE 23.2. An attacker can exploit the vulnerability to upload arbitrary code and execute code on a client computer...
BIT-GITLAB-2020-13264
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...
BIT-GITLAB-2020-13266
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...
BIT-GITLAB-2020-13268
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...
BIT-GITLAB-2020-13269
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1...