2413 matches found
CVE-2020-13270
CVE-2020-13270 affects GitLab Community and Enterprise Editions (CE/EE) from 11.3 up to 13.0.1, due to a missing permission check when creating fork relations. The underlying issue allows guest users to create fork relationships on restricted public projects via the API. The available sources con...
PT-2020-13411 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.3 through 13.0.1 Description: A missing permission check on fork relation creation in GitLab CE/EE allows guest users to create a fork relation on restricted public projects via the API. Recommendations: For GitLab...
CVE-2020-13270: Missing Authorization
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...
USN-4376-1 openssl vulnerabilities
Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL incorrectly handled ECDSA signatures. An attacker could possibly use this issue to perform a timing side-channel attack and recover private ECDSA keys...
Fork CMS Cross-Site Scripting Vulnerability (CNVD-2020-31119)
Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in Fork versions prior to 5.8.3. The vulnerability stems from the lack of proper validation of...
CVE-2020-13633
Fork before 5.8.3 allows XSS via navigationtitle or title...
CVE-2020-13633
Fork before 5.8.3 allows XSS via navigationtitle or title...
Design/Logic Flaw
Fork before 5.8.3 allows XSS via navigationtitle or title...
CVE-2020-13633
Fork CMS prior to version 5.8.3 is vulnerable to cross-site scripting (XSS) due to insufficient escaping of user-supplied values in navigation_title and pageTitle (createHtml()). The vulnerability allows injection of malicious scripts through these fields, with the impact described as XSS in mult...
CVE-2020-13633
Fork before 5.8.3 allows XSS via navigationtitle or title...
CVE-2020-13633
Fork before 5.8.3 allows XSS via navigationtitle or title...
PT-2020-13627
Name of the Vulnerable Software and Affected Versions Fork versions prior to 5.8.3 Description The issue allows for XSS attacks via the navigation title or title variables. This can lead to malicious script execution. Recommendations For versions prior to 5.8.3, update to version 5.8.3 or later t...
Security Bulletin: Multiple vulnerabilities have been identified in OpenSSL, a product which ships with IBM Tivoli Nework Manager
Summary OpenSSL is shipped with IBM Tivoli Network Manager version 3.9 Fix Pack 4 and Fix Pack 5. Information about a security vulnerability affecting OpenSSL is published here. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allow a local authenticated attacker to obtain...
glibc security, bug fix, and enhancement update
2.28-101.0.1 - add Ampere emag to tunable cpu list Patrick McGehearty - add optimized memset for emag - add an ASIMD variant of strlen for falkor - Orabug: 2700101. - Modify glibc-ora28849085.patch so it works with RHCK kernels. - Orabug: 28849085. - Make IOfunlockfile match funlockfile and...
openssl: information disclosure in fork()
OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...
Moderate: Red Hat Security Advisory: openssl security and bug fix update
An update for openssl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Fork CMS 5.8.0 - Persistent Cross-Site Scripting
Title: Fork CMS 5.8.0 - Persistent Cross-Site Scripting Author: Vulnerability Laboratory Date: 2020-04-15 Vendor: https://www.fork-cms.com/download Software Link: https://github.com/forkcms/forkcms/pull/3073 CVE: N/A Document Title: =============== Fork CMS v5.8.0 - Multiple Persistent Web...
Fork CMS 5.8.0 Script Insertion
Document Title: =============== Fork CMS v5.8.0 - Multiple Persistent Web Vulnerbilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2208 ID 3073: https://github.com/forkcms/forkcms/pull/3073 Release Date: ============= 2020-04-17 Vulnerability...
Fork CMS v5.8.0 - Multiple Persistent Web Vulnerbilities
Document Title: =============== Fork CMS v5.8.0 - Multiple Persistent Web Vulnerbilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2208 ID 3073: https://github.com/forkcms/forkcms/pull/3073 Release Date: ============= 2020-04-16 Vulnerability...
openssl: information disclosure in fork()
OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...