BELL-CVE-2023-52592

Bulletin has no description...

BELL-CVE-2023-52593

Bulletin has no description...

BELL-CVE-2023-52586

Bulletin has no description...

BELL-CVE-2023-52588

Bulletin has no description...

BELL-CVE-2023-52589

Bulletin has no description...

BELL-CVE-2024-26627

Bulletin has no description...

BELL-CVE-2024-2236

Bulletin has no description...

OSV-2024-153 Heap-buffer-overflow in od_ec_dec_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67184 Crash type: Heap-buffer-overflow READ 1 Crash state: odecdecinit aomreaderinit tileworkerhookinit...

CVE-2024-28160

Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2024-28149

Jenkins HTML Publisher Plugin 1.16 through 1.32 both inclusive does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting XSS attacks and to determine whether a path on the Jenkins controller file system exists...

GHSA-P2GX-4434-PF6G Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick 1 to solve it. 1...

BIT-GITLAB-2020-10955

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...

BIT-GITLAB-2020-13267

A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1...

BIT-GITLAB-2020-13271

A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1...

BIT-GITLAB-2020-13274

A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1...

BIT-GITLAB-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

BIT-GITLAB-2020-13281

For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature...

BIT-GITLAB-2020-13319

An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue...

BIT-GITLAB-2020-13348

An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are =10.2, =13.4, =13.5, 13.5.2...

BIT-GITLAB-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...