PT-2021-22776 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.3.6 GitLab CE/EE versions 14.4 prior to 14.4.4 GitLab CE/EE versions 14.5 prior to 14.5.2 Description: A collision in access memoization logic leads to potential elevated privileges in groups and projects und...

PT-2021-22781 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.0 to 14.3.6 GitLab CE/EE versions 14.4 to 14.4.4 GitLab CE/EE versions 14.5 to 14.5.2 Description: An information disclosure issue allowed non-project members to see the default branch name for projects that restrict...

CVE-2021-41311: Improper Authentication

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. T...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from US-based GitLab with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An authorization issue vulnerability exists in GitLab Community Edition,...

JetBrains TeamCity has an unspecified vulnerability (CNVD-2022-09215)

JetBrains TeamCity is a distributed build management and continuous integration tool from Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting.A security vulnerability exists in JetBrains TeamCity, which stems from...

GitLab: Arbitrary POST request as victim user from HTML injection in Jupyter notebooks

Summary An attacker can create a Jupyter notebook that will make arbitrary POST requests as the victim user. In the "worst case" an attacker could make an admin create a new admin account for the attacker. Other possible attack vectors are forcing invites to private projects etc. Every POST reque...

Cross-site Scripting (XSS) - Stored in eventum/eventum

Description Multiple Stored XSS in Administration at eventum 3.10.8 Proof of Concept // PoC.payload " Step to Reproduct Goto Administration Areas and choose to feature below Manage News Input payload into fieldTitle Manage Status Input payload into fieldTitle Manage Projects Input payload into...

Jetbrains JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a distributed build management and continuous integration tool from Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis, and build issue analysis reporting.A security vulnerability exists in JetBrains TeamCity, which stems from...

CVE-2021-39905

An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with...

CVE-2021-39895

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...

UBUNTU-CVE-2021-39905

An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with...

PT-2021-22752 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.9.6 and later Description: An information disclosure issue in the GitLab CE/EE API allows a user to view basic information about private groups that a public project has been shared with. Recommendations: For GitLab...

PT-2021-22741 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.0 and later Description: The issue allows an attacker to set pipeline schedules to be active in a project export. When an unsuspecting owner imports that project, pipelines are active by default, potentially leading to...

Atlassian Jira Server and Data Center Cross-Site Scripting Vulnerability (CNVD-2021-87042)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira that allows an anonymous remote attacker to exploit the vulnerability to injec...

CVE-2021-41310

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Associated Projects feature /secure/admin/AssociatedProjectsForCustomField.jspa. The affected versions are before...

Cross site scripting

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Associated Projects feature /secure/admin/AssociatedProjectsForCustomField.jspa. The affected versions are before...

CVE-2021-41310

CVE-2021-41310 : Atlassian Jira Server/Data Center contains a stored XSS in the Associated Projects feature (/secure/admin/AssociatedProjectsForCustomField.jspa). Affected versions are before 8.5.19, from 8.6.0 before 8.13.11, and from 8.14.0 before 8.19.1. An anonymous remote attacker can inject...

CVE-2021-41310

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Associated Projects feature /secure/admin/AssociatedProjectsForCustomField.jspa. The affected versions are before...

CVE-2021-41310

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Associated Projects feature /secure/admin/AssociatedProjectsForCustomField.jspa. The affected versions are before...

PT-2021-23265

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.5.19 Atlassian Jira Server and Data Center versions 8.6.0 through 8.13.11 Atlassian Jira Server and Data Center versions 8.14.0 through 8.19.1 Description The issue allows anonymous...