OpenStack Keystone Domain-scoped tokens don't get revoked

OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain...

SQL Injection

Overview katello is a package that adds Content and Subscription Management to Foreman Affected versions of this package are vulnerable to SQL Injection in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb, exploitable via the sortby and sortorder parameters. Remediatio...

CVE-2022-23607

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to every domain...

PYSEC-2022-26

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. Such cookies are not bound to a single domain, and are therefore sent to every domain...

PT-2022-16122 · Treq +1 · Treq +1

Name of the Vulnerable Software and Affected Versions: treq versions prior to 2021.1.0 Description: The treq library's request methods treq.get, treq.post, etc. and treq.client.HTTPClient constructor accept cookies as a dictionary. These cookies are not bound to a single domain and are sent to...

Huawei HarmonyOS eID component memory out-of-bounds write vulnerability

Huawei HarmonyOS is an operating system from Huawei China. A security vulnerability exists in the eID component of Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker could exploit this vulnerability to compromise confidentiality...

Huawei HarmonyOS memory uninitialized usage vulnerability

Huawei HarmonyOS is an operating system from Huawei China. A security vulnerability exists in the eID component of Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker could exploit this vulnerability to compromise confidentiality...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2022-08458)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS. An attacker could exploit the vulnerability to compromise confidentiality...

Unspecified vulnerability in Huawei HarmonyOS (CNVD-2022-08457)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in a component of Huawei HarmonyOS. An attacker can exploit the vulnerability to bypass the necessary privileges to gain acce...

Governed.sol: setPendingGov() should use the emergency_governed modifier.

Handle itsmeSTYJ Vulnerability details Impact In the event the governor gets compromised leaked pk, unauthorised remote access, phishing etc., you will not be able to recover it with the emergency governor however if the emergency governor gets compromised, you can still resolve the problem w/ th...

jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints.

A flaw was found in the config-file-provider Jenkins plugin. The plugin does not correctly perform permission checks in several HTTP endpoints, as a consequence an attacker with global Job/Configure permission can enumerate system-scoped credentials IDs of credentials stored in Jenkins...

Helm passes repository credentials to alternate domain

While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Impact The index.yaml within a Helm chart repository contains a...

CVE-2021-22199

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

CVE-2021-22199

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

CVE-2021-22199

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

Cross site scripting

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

UBUNTU-CVE-2021-22199

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

CVE-2021-22199

CVE-2021-22199 (GitLab) affects all GitLab versions starting with 12.9 and later. The issue is a stored cross-site scripting (XSS) vulnerability that can be triggered when scoped labels are used. The available sources in the connected documents describe the flaw and its impact as a stored XSS in ...

CVE-2021-22199

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used...

PT-2021-14910 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.9 and later Description: An issue has been discovered in GitLab where it is vulnerable to a stored XSS if scoped labels were used. Recommendations: For GitLab versions 12.9 and later, at the moment, there is no information...