CVE-2019-15723

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

CVE-2019-15723

GitLab CVE-2019-15723 affects GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. The issue allows merge requests created by email to bypass push rules in certain situations, enabling potential unauthorized changes. Remediation is to upgrade to 11.10.1 or later (as the fixe...

CVE-2019-15723

Removed by vendor...

CVE-2019-15723: Missing Authorization

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

PrivExchange - Exchange Your Privileges For Domain Admin Privs By Abusing Exchange

POC tools accompanying the blog Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket, but it is recommended to use the latest version from GitHub. privexchange.py This tool simply logs in on Exchang...

DEBIAN-CVE-2019-16236

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala...

CVE-2019-16236

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala...

CVE-2019-16236: Missing Authorization

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala...

Unspecified Vulnerability in GitLab (CNVD-2019-30488)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

WordPress onesignal-free-web-push-notifications plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. onesignal-free-web-push-notifications is a plugin used to push notifications to site visitors. A cross-site scripting vulnerability...

CVE-2019-15827

The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter...

CVE-2019-15827

The CVE-2019-15827 entry affects the WordPress plugin onesignal-free-web-push-notifications, specifically versions before 1.17.8. The vulnerability is an XSS via the subdomain parameter (POST or input handling) that can lead to client-side script execution within the context of an affected site. ...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)

Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...

CVE-2019-15827: Improper Neutralization of Input During Web Page Generation

The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter...

The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, nginx servers, network programming tools like netty, Envoy, SwiftNIO, and Node.js software platforms. This allows attackers to induce service failures.

The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, nginx servers, network programming tools like Netty, Envoy, SwiftNIO, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a maliciou...

ALPINE-CVE-2019-10081

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

DEBIAN-CVE-2019-10081

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

EUVD-2019-2135

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

CVE-2019-10081

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...

UBUNTU-CVE-2019-10081

HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client...