GitLab 11.3.4 < 15.1.5, 15.2.x < 15.2.3, 15.3.x < 15.3.1 RCE Vulnerability

GitLab is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; ...

IBM MQ XXE (6613021)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 6613021 advisory. - IBM MQ Explorer is vulnerable to an XML External Entity Injection XXE attack due to improper XML validation in the import Wizard. CVE-2022-22489 Note that Nessus has not...

The vulnerability of the import function in GitHub’s software platform, based on Git, for collaborative code development on GitLab, allows a perpetrator to execute arbitrary code.

The vulnerability of the import function in GitHub’s software platform for Git-based collaborative code development on GitLab is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the target system...

Vulnerabilities fixed in GitLab Enterprise Edition and GitLab Community Edition

GitLab has fixed a vulnerability in GitLab Enterprise Edition and GitLab Community Edition. An authenticated malicious party could exploit the vulnerability to execute arbitrary code via the 'Import from GitHub' API Endpoint to execute arbitrary code with permissions from the application and...

UBUNTU-CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to...

WP Taxonomy Import <= 1.0.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting PoC...

Gitlab -- Remote Code Execution

Gitlab reports: Remote Command Execution via Github import...

WP Taxonomy Import <= 1.0.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting alert/XSS/" /...

WordPress WP Taxonomy Import plugin <= 1.0.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by kaikaix in WordPress WP Taxonomy Import plugin versions = 1.0.4. Solution Deactivate and delete. This plugin has been closed as of August 5, 2022 and is not available for download. This closure is temporary, pending a full review...

PT-2022-4351

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.3.4 through 15.1.5 GitLab CE/EE versions 15.2 through 15.2.3 GitLab CE/EE versions 15.3 through 15.3.1 Description A vulnerability in GitLab CE/EE allows an authenticated user to achieve remote code execution via the...

Malicious code in eslinft-pluuin-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 724af609bd3a7b5b974a4abc0dd819a490c7f6c7ab2181f365a8b347ccf1130a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2791 Malicious code in eslinft-pluuin-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 724af609bd3a7b5b974a4abc0dd819a490c7f6c7ab2181f365a8b347ccf1130a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babel-lugin-dynamic-i9port-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15795da980aca09e89837d11f5565a68c61e5b779062fae4eb410f3a24bddbc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1450 Malicious code in bael-plugin-syntax-dynramic-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca89ab83d060f762a8d1c46b906c3441300e2971fa90c2eb35024e919b2d0c97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1404 Malicious code in babel-lugin-dynamic-i9port-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15795da980aca09e89837d11f5565a68c61e5b779062fae4eb410f3a24bddbc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1444 Malicious code in bablpluginsyntaxdynamicimport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c59572f2bc92d923ebe87aeee4cc1ccb84e1e60c29e5f6fbe6a0ca8bda407b8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM MQ 代码问题漏洞

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. It provides a reliable and proven messaging backbone for Service Oriented Architecture SOA. A security vulnerability exists in IBM MQ that stems from an attacker being able to transfer malicious XML data to IBM MQ via the Explore...

Stored XSS in 'Table name' field via Database information function

Description When the administrator uses the Database information function, malicious code will be accidentally called and executed through two cases: 1. 1 An internal attacker local with access right to the database could insert malicious content into the table name field by creating a table in t...

Restore to Google Cloud Engine Fails With "n1-standard-2 not found"

The Restore to Google Compute Engine utilizes the import-image API call, which in turn requires an N1 instance type, which is an instance type that is not available in certain regions...

WWBN AVideo aVideoEncoder chunkfile OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1546 WWBN AVideo aVideoEncoder chunkfile OS command injection vulnerability August 16, 2022 CVE Number CVE-2022-30534 SUMMARY An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit...