CVE-2024-47767

Tuleap CVE-2024-47767 affects Tuleap: before fixes, users could view tracker names they should not have access to via the backlog quick-add actions. The issue is caused by missing permissions checks in the quick-add/backlog flow. Impact is exposure of restricted tracker names (information disclos...

CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

CVE-2024-47766

CVE-2024-47766 affects Tuleap: prior to versions Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, project administrators could access tracker content via the cross tracker search widget despite permission restrictions. The issue is f...

CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Mitm Bug Tracker versions = 1.0...

Enalean Tuleap 安全漏洞

Enalean Tuleap is a free and open source tool from the French company Enalean. It is used for end-to-end traceability of application and system development. A security vulnerability exists in Enalean Tuleap. An attacker exploiting the vulnerability could view tracker names that they should not ha...

WordPress Mitm Bug Tracker Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Mitm Bug Tracker Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49224 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7b5fcd32755d Credits Mika Required privilege...

Debian dla-3917 : python-reportlab-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3917 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3917-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DSA 5729-2] apache2 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5729-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 08, 2024 https://www.debian.org/security/faq -...

Debian dsa-5785 : mediawiki - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5785 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5785-1 [email protected] https://www.debian.org/security/ Moritz...

Debian dsa-5783 : firefox-esr - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5783 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5783-1 [email protected] https://www.debian.org/securit...

[SECURITY] [DLA 3908-1] debian-security-support update

Debian LTS Advisory DLA-3908-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón September 30, 2024 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:11+2024.09.30 Debian Bug : 1063756 debian-security-support, the Debian security suppor...

CVE-2024-45792

Mantis Bug Tracker MantisBT is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4...

Mantis Bug Tracker 信息泄露漏洞

Mantis Bug Tracker MantisBT is a bug tracker from Mantis Bug Tracker open source. An information disclosure vulnerability exists in Mantis Bug Tracker version 2.26.3 and earlier versions. An attacker exploits this vulnerability to retrieve information about another user's personal system...

PT-2024-31773 · Unknown · Mantis Bug Tracker

Name of the Vulnerable Software and Affected Versions: Mantis Bug Tracker MantisBT versions prior to 2.26.4 Description: The issue allows an unprivileged, registered user to retrieve information about other users' personal system profiles using a crafted POST request. This can lead to the...

Debian dla-3903 : libunbound-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3903 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3903-1 [email protected]...

Debian dsa-5775 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5775 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5775-1 [email protected] https://www.debian.org/securit...

CVE-2024-45613

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting XSS vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code...

Malicious code in cgpt_burn_tracker_frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6e14d717ae90e2a54db35f9e5962f984fc420b2afa1d3b8e0bc0d3631d7945bb The OpenSSF Package Analysis project identified 'cgptburntrackerfrontend' @ 1.0.2 npm as malicious. It is considered malicious because: - The...

Debian dla-3891 : libmariadb-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3891 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3891-1 [email protected] https://www.debian.org/lts/security/...