DEBIAN-CVE-2021-3446

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

GitLab server-side request forgery vulnerability (CNVD-2021-26068)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. GitLab suffers from a server-side request forgery vulnerability that can be exploited via Prometheu...

The vulnerability of the integration component of the Magento Commerce software development and management platform, related to authentication errors, allows attackers to gain unauthorized access to protected information.

The vulnerability of the integration component of the Magento Commerce software development and management platform is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by using...

The vulnerability of the integration component of the Magento Commerce software development and management platform relates to the lack of protection against cross-site request forgery attacks. This allows attackers to perform unauthorized changes to user metadata.

The vulnerability of the integration component of the Magento Commerce software platform for online store development and management is related to the lack of protection against cross-site request forgery attacks. Exploiting this vulnerability allows a malicious actor to perform unauthorized...

Active Exploits Hit WordPress Sites Vulnerable to Thrive Themes Flaws

Attackers are actively exploiting two recently-patched vulnerabilities in a popular suite of tools for WordPress websites from marketing platform Thrive Themes. Thrive Themes offers various products to help WordPress websites “convert visitors into leads and customers.” Its suite of products,...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

Information disclosure

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

UBUNTU-CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

Removed by vendor...

CVE-2021-22178

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration...

CVE-2021-22178

Summary: CVE-2021-22178 affects GitLab versions starting from 13.2 and earlier, due to a SRRF attack via the Prometheus integration. The connected sources consistently describe this as a vulnerability in GitLab exposing potential risks when Prometheus is enabled, but do not provide vendor-specifi...

PT-2021-14890 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.2 and later Description: An issue has been discovered in GitLab, making it vulnerable to a Server-Side Request Forgery SRRF attack through the Prometheus integration. Recommendations: For GitLab versions 13.2 and later, at...

PT-2021-14897 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.4 and up Description: An authorization issue allowed a group maintainer to modify group CI/CD variables, which should be restricted to group owners. Recommendations: For GitLab CE/EE versions 9.4 and up, consider...

Unauthorized Access Vulnerability in GLIS, the General Library Integrated Management System of Beijing Qingda Xinyang Technology Co. Ltd (CNVD-2021-25891)

Ltd. is a high-tech enterprise in Beijing New Technology Industrial Development Zone, with a registered capital of RMB 10 million yuan and a number of subsidiaries Beijing Zhongke Xinyang Science and Technology Co., Ltd. and Zhejiang Qingda Xinyang Science and Technology Co., Ltd.. Relying on the...

GitLab 代码问题漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. GitLab suffers from a server-side request forgery vulnerability that can be exploited via Prometheu...

Unified Dashboard Preview for Enhanced Security Visualization

Qualys has introduced the Unified Dashboard Framework UDF to enrich your dashboarding experience. Unified Dashboard UD brings information from all Qualys applications into a single place for visualization. UD adds a powerful new dashboarding framework to the Qualys Cloud Platform that will be...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Node.js vulnerabilities (CVE-2020-1971, CVE-2020-8265, and CVE-2020-8287)

Summary IBM Cloud Pak for Integration is vulnerable to Node.js vulnerabilities CVE-2020-1971, CVE-2020-8265, and CVE-2020-8287 with details of each below. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities (CVE-2021-3114 and CVE-2021-3115)

Summary IBM Cloud Pak for Integration is vulnerable to Go vulnerabilities CVE-2021-3114 and CVE-2021-3115 with details of each below. Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an...