springframework: DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

CVE-2019-4553

IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165958...

thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

Vesta Control Panel as System Command Injection Vulnerability

Vesta Control Panel VestaCP is an open source web hosting control panel. An operating system command injection vulnerability exists in VestaCP versions 0.9.7 through 0.9.8-23. An attacker can exploit this vulnerability to elevate privileges...

Eclipse Theia Data Forgery Issue Vulnerability

Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A data forgery vulnerability exists in Eclipse Theia versions 0.3.9 through 0.15.0. A remote attacker can exploit this vulnerability...

GitLab Improper Authorization Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

WeeChat Denial of Service Vulnerability

WeeChat is a scalable live chat client application. A code issue vulnerability exists in WeeChat versions 0.4.0 through 2.7. An attacker could exploit the vulnerability to cause a denial of service...

activemq: Corrupt MQTT frame can cause broker shutdown

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive...

CVE-2020-10534

In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled...

IBM DataPower Gateway Security Bypass Vulnerability

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2020-21501)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in Dolibarr ERP/CRM...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-19605)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

GitLab Information Disclosure Vulnerability (CNVD-2020-19229)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An information disclosure vulnerability exists in GitLab 12.3.5 - 12.8.1. An attacker can exploit...

UBUNTU-CVE-2020-10074

GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link...

Joomla! access control error vulnerability (CNVD-2020-20997)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in Joomla! versions 2.5.0 through 3.9.15, which stems from a failure to perform ACL checks for various...

PT-2020-11899 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.1 through 12.8.1 Description: A scenario was discovered in which a GitLab account could be taken over through an expired link, indicating an issue with access control. Recommendations: For GitLab versions 10.1 through 12.8....

PT-2020-11914 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.11 through 12.8.1 Description: The issue allows a Denial of Service when using several features to recursively request each other. Recommendations: For GitLab versions 8.11 through 12.8.1, update to a version that contains a...

Joomla! SQL Injection Vulnerability (CNVD-2020-21002)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A SQL injection vulnerability exists in Joomla! versions 1.7.0 through 3.9.15, which stems from a lack of validation of externally-entered SQL...

CVE-2020-10534

In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled...

CVE-2020-10534

In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled...