CVE-2020-2096

The Jenkins Gitlab Hook Plugin (version 1.4.2 and earlier ) is vulnerable to a reflected cross-site scripting (XSS) vulnerability because it fails to properly escape project names in the build_now endpoint. An attacker could exploit this to execute arbitrary JavaScript in a victim's browser, pote...

CVE-2020-2096

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected XSS vulnerability...

CVE-2020-2096: Improper Neutralization of Input During Web Page Generation

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected XSS vulnerability...

PT-2020-10335

Name of the Vulnerable Software and Affected Versions Bitbucket Server and Bitbucket Data Center versions prior to 5.16.11 Bitbucket Server and Bitbucket Data Center versions 6.0.0 through 6.0.10 Bitbucket Server and Bitbucket Data Center versions 6.1.0 through 6.1.8 Bitbucket Server and Bitbucke...

CVE-2019-20097: Undefined Security Weakness

Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from versi...

Reflected XSS vulnerability in gitlab-hook

gitlab-hook 1.4.2 and earlier does not escape project names in the buildnow endpoint. This results in a reflected cross-site scripting vulnerability. As of publication of this advisory, there is no fix...

vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities

According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x 5.5.2 Patch Level 2, 5.5.3 5.5.3 Patch Level 2 or 5.5.4 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities : - A SQL injection vulnerability v...

CVE-2013-0163

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS...

CVE-2013-0163

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS...

Design/Logic Flaw

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS...

CVE-2013-0163: Exposure of Resource to Wrong Sphere

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS...

PT-2019-6715

Name of the Vulnerable Software and Affected Versions CKEditor module version 7.x-1.4 for Drupal Description The issue is related to the hook file download function in the CKEditor module, which does not properly restrict access to private files. This allows remote attackers to read private files...

Sql injection

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...

CVE-2019-17271

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...

CVE-2019-17271

CVE-2019-17271 affects vBulletin 5.x, specifically the 5.5.4 release, where an SQL injection flaw exists in the AJAX endpoints ajax/api/hook/getHookList and ajax/api/widget/getWidgetList via an unsafely handled parameter. The vulnerability stems from improper input handling in these endpoints, en...

PT-2019-15053

Name of the Vulnerable Software and Affected Versions vBulletin version 5.5.4 Description The issue allows SQL Injection via the "ajax/api/hook/getHookList" or "ajax/api/widget/getWidgetList" API endpoints, where a specific parameter is vulnerable. Recommendations For version 5.5.4, consider...

CVE-2019-17271: Improper Neutralization of Special Elements used in an SQL Command

vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter...

ALPINE-CVE-2019-14811

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the fi...

CVE-2019-14811

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the fi...

Bitbucket 6.1.1 Path Traversal to RCE

Impact In Bitbucket the four different user roles Bitbucket User, Project Creator, Admin and System Admin exist. An attacker with the permissions of the role Admin can abuse Bitbuckets Data Center Migration tool to drop an executable shell script in an arbitrary directory. This is caused by a...