SUSE-SU-2018:0952-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: - Fix some node-gyp permissions - New upstream maintenance 4.9.1: Security fixes: + CVE-2018-7158: Fix for 'path' module regular expression denial of service bsc1087459 + CVE-2018-7159: Reject spaces in HTTP Content-Length header values bsc10874...

Gitlab cross-site scripting vulnerability (CNVD-2018-06861)

GitLab is a set of Ruby on Rails development of open source applications , can be realized as a self-hosted Git version control system project repository , which has similar features to Github , you can check the project's file content , commit history , bug lists , etc. GitLab Community Edition ...

Cross site scripting

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

CVE-2017-0917

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

CVE-2017-0918

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

CVE-2017-0917

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

CVE-2017-0917

CVE-2017-0917: GitLab Community Edition v10.2.4 vulnerability in the CI job component due to lack of input validation, causing persistent cross-site scripting. Confirmed details across multiple sources indicate a remote attacker could inject arbitrary script via CI job output, leading to potentia...

CVE-2017-0917

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

CVE-2017-0918

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

CVE-2017-0918

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

CVE-2017-0917

Removed by vendor...

CVE-2017-0917: Improper Neutralization of Input During Web Page Generation

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

CVE-2017-0918: Relative Path Traversal

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

Debian DSA-4145-1 : gitlab - security update

Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code : - CVE-2017-0915/ CVE-2018-3710 Arbitrary code execution in project import. - CVE-2017-0916 Command injection via Webhooks. - CVE-2017-0917 Cross-site scripting in CI job output. - CVE-2017-0918...

PT-2018-5144

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.2.4 Description The issue is related to a lack of input validation in the CI job component, resulting in persistent cross-site scripting. This allows for malicious scripts to be injected and executed,...

PT-2018-5145

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to a path traversal problem in the GitLab CI runner component, which results in remote code execution. Recommendations For Gitlab Community Edition version 10.3, update to ...

CVE-2018-1227: Undefined Security Weakness

Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI concourse-dot-ci open source project has been registered...

PT-2018-11091

Name of the Vulnerable Software and Affected Versions Pivotal Concourse versions after 2018-03-05 Description The issue affects Pivotal Concourse, potentially allowing remote attackers to have an unspecified impact if a customer obtained the software from a DNS domain no longer controlled by...

CVE-2018-1227: Concourse-dot-ci domain issue | Cloud Foundry

Severity High/Advisory Vendor Concourse CI Affected Products and Versions Please see the notice available at https://pivotal.io/security/cve-2018-1227. References https://pivotal.io/security/cve-2018-1227 Description The original domain for the Concourse CI concourse-dot-ci open source project ha...

GSA Bounty: CI for [example.gov] can be logged in and accessible

When anyone searched a public search engine for inurl:example.gov where example.gov was one of the URLs in the TTS Bug Bounty scope, the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in",...