4833 matches found
CVE-2020-13351: Incorrect Default Permissions
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...
CVE-2020-13348: Undefined Security Weakness
An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are =10.2, =13.4, =13.5, 13.5.2...
CVE-2020-26406: Undefined Security Weakness
Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...
CVE-2020-13350: Cross-Site Request Forgery (CSRF)
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are =13.5.0, =13.4.0, 13.4.5,13.3.9...
CVE-2020-13349: Uncontrolled Resource Consumption
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are =8.12, =13.4, =13.5, 13.5.2...
CVE-2020-13352: Undefined Security Weakness
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: =10.2, =13.4, =13.5, 13.5.2...
CVE-2020-13358: Undefined Security Weakness
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: =13.4, =13.3, =13.5, 13.5.2...
rehvid365.ee Cross Site Scripting vulnerability OBB-1393328
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
PT-2020-14663 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 7.3.1 Liferay Portal 6.2 EE Liferay DXP versions prior to 7.2 Description: The issue allows the property 'portlet.resource.id.banned.paths.regexp' to be bypassed using doubled encoded URLs. Recommendations: Fo...
Authorization
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...
CVE-2020-13300
GitLab CE/EE 13.3 prior to 13.3.4 is affected by CVE-2020-13300 due to an OAuth authorization scope change without user consent during the authorization flow. This could enable unintended expansion of granted permissions during OAuth. Remediation: upgrade to GitLab 13.3.4 or later. CVSS metrics i...
CVE-2020-13300
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...
CVE-2020-13300: Incorrect Authorization
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...
Fedora: Security Advisory for eclipse-webtools (FEDORA-2020-cf8ef2f333)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 32 Update: eclipse-webtools-3.18.0-4.fc32
Eclipse Webtools. This contains sub-packages for different sub-projects of Eclipse Webtools project, including Server Tools, SourceEditing Tools, Webservices Tools, Java EE Tools, JSF Tools, and Dali JPA Tools...
Improper access control
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint...
CVE-2020-15525
CVE-2020-15525 affects GitLab EE versions 11.3–13.1.2 and is caused by Incorrect Access Control at the Maven package upload endpoint. The issue enables unauthorized access via Maven Repository APIs (impact described as partial confidentiality in CVSS terms); some sources note potential access to ...
CVE-2020-15525
Removed by vendor...
