Gitlab -- Multiple vulnerabilities

Gitlab reports: JWT token leak via Workhorse Stored XSS in wiki pages Group Maintainers are able to use the Group CI/CD Variables API Insecure storage of GitLab session keys...

CVE-2021-22863

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker woul...

CVE-2021-22863

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker woul...

CVE-2020-26247

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the...

CVE-2017-17361

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...

GitLab Improper Authorization Vulnerability (CNVD-2020-52425)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An improper authorization vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and...

CheckXSS - Detect XSS vulnerability in Web Applications

DetectXSS vulnerability in Web Applications Screenshots Easy Installation As simple as below, Just one line of code: curl -L -s https://raw.githubusercontent.com/Jewel591/CheckXSS/master/docs/install.sh|bash Usage Instructions python3.6 checkxss.py -h Support POST and GET request methods, support...

mach is unmaintained

Last release was almost 4 years ago. Maintainers seem to be completely unreachable. Possible Alternatives These may or may not be suitable alternatives and have not been vetted in any way; - mach2 - direct fork...

CVE-2020-13264

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...

Code injection

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...

CVE-2020-13264

Removed by vendor...

PT-2020-13405 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.3 through 13.0.1 Description: The issue allows other group maintainers to view Kubernetes cluster tokens, potentially leading to unauthorized access. Recommendations: For GitLab CE/EE versions 10.3 through 13.0.1,...

TeaBreak - A Productivity Burp Extension Which Reminds To Take Break While You Are At Work!

TeaBreak is a simple burp extension for security researchers and bug bounty hunters for helping them to increase their work productivity. We know how much health is important. It is recommended to take break from your work to avoid burnout, reduce eye strain and other health problems. How? Set yo...

CVE-2020-13976

An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it...

GitLab: Insufficient Type Check on GraphQL leading to Maintainer delete repository

Summary As you have know, Maintainer cannot delete/archive repository. But via GraphQL, they can do as there exists an sufficient check on GraphQL API app/graphql/mutations/snippets/destroy.rb ruby def resolveid: snippet = authorizedfind!id: id response = ::Snippets::DestroyService.newcurrentuser...

CVE-2020-10981

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

CVE-2020-10981

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

CVE-2020-10981

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

Design/Logic Flaw

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

CVE-2020-10981

GitLab CE/EE versions 9.0–12.9 are affected by CVE-2020-10981, which allows a project maintainer to modify other maintainers’ pipeline trigger descriptions within the same project. The issue is tied to GitLab’s 12.9.x series and is documented with public advisories (see GitLab security releases)....