GitLab EE Path Traversal Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A path traversal vulnerability exists in the NPM feature ...

CVE-2019-4553

IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165958...

thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

Vesta Control Panel as System Command Injection Vulnerability

Vesta Control Panel VestaCP is an open source web hosting control panel. An operating system command injection vulnerability exists in VestaCP versions 0.9.7 through 0.9.8-23. An attacker can exploit this vulnerability to elevate privileges...

Eclipse Theia Data Forgery Issue Vulnerability

Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A data forgery vulnerability exists in Eclipse Theia versions 0.3.9 through 0.15.0. A remote attacker can exploit this vulnerability...

GitLab Improper Authorization Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

WeeChat Denial of Service Vulnerability

WeeChat is a scalable live chat client application. A code issue vulnerability exists in WeeChat versions 0.4.0 through 2.7. An attacker could exploit the vulnerability to cause a denial of service...

activemq: Corrupt MQTT frame can cause broker shutdown

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive...

IBM DataPower Gateway Security Bypass Vulnerability

IBM DataPower Gateway is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2020-21501)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in Dolibarr ERP/CRM...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-19605)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

GitLab Information Disclosure Vulnerability (CNVD-2020-19229)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An information disclosure vulnerability exists in GitLab 12.3.5 - 12.8.1. An attacker can exploit...

UBUNTU-CVE-2020-10074

GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link...

Joomla! access control error vulnerability (CNVD-2020-20997)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in Joomla! versions 2.5.0 through 3.9.15, which stems from a failure to perform ACL checks for various...

PT-2020-11899 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.1 through 12.8.1 Description: A scenario was discovered in which a GitLab account could be taken over through an expired link, indicating an issue with access control. Recommendations: For GitLab versions 10.1 through 12.8....

PT-2020-11914 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.11 through 12.8.1 Description: The issue allows a Denial of Service when using several features to recursively request each other. Recommendations: For GitLab versions 8.11 through 12.8.1, update to a version that contains a...

Joomla! SQL Injection Vulnerability (CNVD-2020-21002)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A SQL injection vulnerability exists in Joomla! versions 1.7.0 through 3.9.15, which stems from a lack of validation of externally-entered SQL...

thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

PT-2020-5140

Name of the Vulnerable Software and Affected Versions urllib3 library versions 1.25.2 through 1.25.7 Description The issue is related to an inefficient algorithm in the encode invalid chars function, which can lead to a denial of service due to CPU consumption. This happens because the percent...

Selesta Visual Access Manager Information Disclosure Vulnerability

Selesta Visual Access Manager VAM is the Selesta Visual Access Manager. A security vulnerability exists in Selesta Visual Access Manager VAM versions 4.15.0 through 4.29, which stems from the /common/vameditXml.php page not checking the parameter used to specify the name of the file to read. An...