CVE-2024-20671: Incorrect Default Permissions

Microsoft Defender Security Feature Bypass Vulnerability...

CVE-2024-21427: Improper Authentication

Windows Kerberos Security Feature Bypass Vulnerability...

APSB24-05 : Security update available for Adobe Experience Manager

Adobe has released updates for Adobe Experience Manager AEM. These updates resolve vulnerabilities rated important and moderate. Successful exploitation of these vulnerabilities could result in arbitrary code execution and security feature bypass...

GO-2024-2604 CORS Filter bypass in github.com/zeromicro/go-zero

The CORS Filter feature in go-zero allows users to specify an array of domains allowed in the CORS policy. However, the isOriginAllowed function uses strings.HasSuffix to check the origin, which can lead to a bypass via a domain like "evil-victim.com". This vulnerability is capable of breaking CO...

WordPress plugin Mollie Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Improper Access Control

GitLab is vulnerable to Improper Access Control. The vulnerability is due to an authorization bypass affecting gitlab. An attacker could exploit this by utilizing a crafted payload in an old feature branch to bypass CODEOWNERS and perform malicious actions...

PT-2024-19706

Name of the Vulnerable Software and Affected Versions Django MarkdownX version 4.0.2 Description A Cross-Site Scripting XSS issue exists in the Django MarkdownX project due to the lack of proper sanitisation of JavaScript elements. This allows an attacker to store a specially crafted JavaScript...

FreeBSD : Gitlab -- Vulnerabilities (b2caae55-dc38-11ee-96dc-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b2caae55-dc38-11ee-96dc-001b217b3468 advisory. - An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior...

[SECURITY] Fedora 40 Update: mysql-connector-java-8.0.30-6.fc40

MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...

[SECURITY] Fedora 40 Update: jakarta-saaj-3.0.0-6.fc40

Jakarta SOAP with Attachments defines an API enabling developers to produce and consume messages conforming to the SOAP 1.1, SOAP 1.2, and SOAP Attachments Feature...

CVE-2024-0199

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions...

CVE-2024-0199

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions...

Authorization

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions...

UBUNTU-CVE-2024-0199

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions...

CVE-2024-0199

Removed by vendor...

CVE-2024-0199 Incorrect Authorization in GitLab

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions...

Schoolbox Cross-Site Scripting Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A cross-site scripting vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from a cross-site scripting vulnerability in the Calendar feature that allows an authenticated attacker to perform a secure operation i...

PT-2024-15381 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.3 through 16.7.6 GitLab versions 16.7.6 through 16.8.3 GitLab versions 16.8.3 through 16.9.1 Description: An authorization bypass vulnerability was discovered in GitLab, allowing an attacker to bypass CODEOWNERS by utilizin...

VulnCheck KEV: CVE-2020-13379

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network th...

Schoolbox Cross-Site Scripting Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A cross-site scripting vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from a cross-site scripting vulnerability in the Classes feature that would allow an authenticated attacker to perform a secure operati...