ProjectSend Security Vulnerability

ProjectSend formerly cFTP is a suite of self-hosted applications based on PHP and MySQL. ProjectSend before r1295 suffers from a security vulnerability that incorrectly resets passwords due to faulty business logic...

GitLab Denial of Service Vulnerability (CNVD-2021-26072)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A regular expression denial of service vulnerability exists in the NuGet API in GitLab 12.8 and lat...

GitLab Authorization Issues Vulnerability (CNVD-2021-04822)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in Gitlab, which arises...

GitLab 资源管理错误漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in Gitlab, which arises...

Code Injection in archivy/archivy

Description Archivy is a self-hosted knowledge repository that allows you to safely preserve useful content that contributes to your knowledge bank. Vulnerability description Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Run exploit.py python import os...

GitLab Information Disclosure Vulnerability (CNVD-2021-14193)

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. GitLab CE/EE...

GitLab CE/EE Cross-Site Request Forgery Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...

GitLab Authorization Issues Vulnerability (CNVD-2020-63398)

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-26074)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A reflective cross-site scripting vulnerability exists in GitLab 10.8 and later, no details of the...

GitLab Github Project Import Restriction Bypass Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A Github project import restriction bypass vulnerability exists in GitLab versions prior to 13.1. A...

GitLab Session Fixation Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A session fixation vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and 13.3.4. Th...

GitLab Server-Side Request Forgery Vulnerability (CNVD-2020-52182)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A server-side request forgery vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and...

GitLab Excess Authentication Attempts Improperly Restricted Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An improperly restricted over-authentication attempt vulnerability exists in the GitLab OAuth...

GitLab Elevation of Privilege Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An elevation of privilege vulnerability exists in GitLab,...

GitLab Information Disclosure Vulnerability (CNVD-2020-51541)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

Cross-Site Scripting in yui

Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url. Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if you are not...

GitLab: Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances

NOTE: I am still researching whether there is a possibility to deploy the exploit without user interaction. Summary GitLab provides a rich representation for Jupyter Notebooks .ipynb. In turn, Jupyter Notebooks provide the possibility for rich output via HTML. Although most tags and attributes ar...

GitLab Memory Exhaustion Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions prior ...

onefuzz

:exclamation: IMPORTANT NOTICE :exclamation: August 31...

GitLab Data Forgery Issue Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise...