CVE-2024-1347 Authentication Bypass by Spoofing in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restriction...

CVE-2024-1347

Removed by vendor...

CVE-2024-2829

CVE-2024-2829 affects GitLab CE/EE: 12.5–16.9.6 (before 16.9.6), 16.10 before 16.10.4, and 16.11 before 16.11.1. Root cause: crafted wildcard filter in FileFinder can cause denial of service. Remediation per advisories: update to fixed releases (16.9.6, 16.10.4, 16.11.1 or newer) as noted by NCSC...

PT-2024-3105 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.9 prior to 16.9.6 GitLab CE/EE versions 16.10 prior to 16.10.4 GitLab CE/EE versions 16.11 prior to 16.11.1 Description: The issue is related to incorrect limitation of the path name to a directory with restricted...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2024-1533)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.10.0 : libssh2 (EulerOS-SA-2024-1529)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacke...

Judge0 CE 安全漏洞

Judge0 CE is an open source online code execution system from Judge0 Open Source. A security vulnerability exists in Judge0 CE versions prior to 1.13.1, which originates from an application using UNIX commands on untrusted files inside the sandbox, and can be exploited by an attacker to create...

BIT-GITLAB-2023-6489 Inefficient Regular Expression Complexity in GitLab

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature...

CVE-2023-6489

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature...

CVE-2024-2279

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowin...

CVE-2023-6489

CVE-2023-6489 affects GitLab CE/EE: vulnerable in GitLab versions 16.7.7 before 16.8.6, 16.9 before 16.9.4, and 16.10 before 16.10.2. The issue allows a denial-of-service by spiking resource usage via the chat integration feature. The root cause is described in OSV entries as inefficient regular ...

CVE-2024-2279 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowin...

CVE-2024-3092

CVE-2024-3092 affects GitLab CE/EE: stored XSS via the diff viewer in all versions 16.9 before 16.9.4 and 16.10 before 16.10.2. Exploitation could allow an attacker to act on behalf of victims. Remediation: upgrade to GitLab 16.9.4 or 16.10.2 (per advisories referencing the fixed versions).

CVE-2024-29296

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not...

CVE-2024-29296

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not...

CVE-2024-29296

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not...

CVE-2024-29296

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not...

PT-2024-5801 · Unknown +1 · Portainer Ce +1

Name of the Vulnerable Software and Affected Versions: Portainer CE version 2.19.4 Description: A user enumeration issue is present in the user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. This...

BIT-GITLAB-2023-6371 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf...

The vulnerability of the english.php file in the e-commerce software for CE Phoenix (CE PhoenixCart) allows a hacker to execute arbitrary code.

The vulnerability of the english.php file in the e-commerce software CE Phoenix CE PhoenixCart is related to deficiencies in eliminating special characters. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...