PT-2020-13089 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 9.5.9 through 12.9 Description: The issue concerns a stored XSS vulnerability in an admin notification feature. This allows for malicious code to be stored and executed when the notification is viewed by an administrator...

PT-2020-13090 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 through 12.9 Description: The issue allows someone to mirror a repository even if the feature is not activated. Recommendations: For GitLab versions 10.8 through 12.9, update to a version that contains a fix for this issu...

Cybozu Garoon License Issue Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An authorization issue vulnerability exists in Cybozu Garoon versions 4.0.0 to 4.10.3. A remote attacker can...

Cybozu Garoon Code Issue Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A code issue vulnerability exists in the V-CUBE Meeting feature in Cybozu Garoon versions 4.0.0 through 4.10.3. A...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2020-26661)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.3. A remote attacker can...

Unspecified Vulnerability in GitLab (CNVD-2020-25737)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

CVE-2020-2826

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Print Server. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One...

auth0.js Information Disclosure Vulnerability

auth0.js is a client-side JavaScript toolkit for the Auth0 API Application Programming Interface. A security vulnerability exists in auth0.js NPM package auth0-js versions 8.0.0 through 9.13.1. An attacker can exploit the vulnerability to obtain a password...

CVE-2020-4291

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334...

CVE-2020-4164

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400...

PT-2020-12466 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 9.0 through 12.9 Description: The issue allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. Recommendations: For GitLab EE/CE versions 9.0 through 12.9, consider...

CVE-2016-11026

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, and M6.0 software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 December 2016...

CVE-2020-4303

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Apache HTTP Server Uninitialized Memory Vulnerability

Apache HTTP Server is the United States Apache Software Apache Software Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.41, which stems from modproxyft...

AZL-44904 CVE-2019-11254 affecting package delve 1.5.0-16

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML...

PT-2020-2798 · Sds · Sds

Name of the Vulnerable Software and Affected Versions: sds versions 0.0.0 through 3.2.0 Description: The issue is related to Prototype Pollution, where the library can be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. This is...

IBM Spectrum Protect Plus Command Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20699)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

F5 BIG-IP Buffer Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 12.1.0 through 12.1.5. An attacker can exploit the vulnerability to caus...