Buffer Overflow

SQLite is vulnerable to heap-based buffer overflow. The vulnerability is due to the sessionReadRecord function within ext/session/sqlite3session.c, which allows an attacker to manipulate the pIn parameter which results in a buffer overflow...

Weak Hashing Algorithm

bsock is vulnerable to a Weak Hashing Algorithm. The vulnerable is due to the libraries usage of weak hashing algorithm MD5, SHA1 within vendor\faye-websocket.js. This could allow an attacker to break the confidentiality of the websocket communication...

CGI Abuse

Gitlab is vulnerable to CGI Abuse. An attacker can abuse scan execution policies to run pipelines as another user compromising Confidentiality and Integrity of the system...

Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial of Service. The vulnerability is due to inefficient regular expression complexity in GitLab's Jira prefix handling,this allows with certain inputs causing excessive consumption of resources thats leading to a ReDoS...

Improper Authorization

gitlab:sid is a vulnerable of improper authorization. The vulnerability due to effect of GitLab CE/EE and it does not performs an authorization check when an actor attempts to access. It leads to improper authorization by allow an attacker to leak the owner's Sentry instance projects...

Improper Access Control

gitlab:sid is vulnerable of improper access control. The vulnerability due to improper permission validation and fails to authorization check. It leads to allow an attacker to edit labels description by an unauthorized user...

Denial Of Service (DOS)

gitlab is vulnerable to Denial Of Service. The vulnerability is due to lack of proper input sanitization in the search functionality of the Harbor Registry, allowing attackers for the execution of a Regular Expression Denial of Service through specially crafted payloads...

Stack Buffer Overflow

MP3Gain is vulnerable to Stack Buffer Overflow. The vulnerability is caused due to the WriteMP3GainAPETag function.This potentially leads to Denial of Service DoS Attack...

Code Injection

gitlab:sid is vulnerable of code injection. The vulnerability due to compromise the source code and incorrectly neutralizes special elements in GitLab CE/EE. It leads to allow an attacker to modify the syntax or behavior of the intended code segment...

Cross-site Scripting

gitlab:sid is vulnerable of cross site scripting. The vulnerability due to the manipulation with an unknown input in Jira integration configuration in GitLab CE/EE and does not neutralize user-controllable input before it is placed in output. It leads to cross site scripting by allow an attacker ...

Improper Access Control

gitlab:sid is vulnerable of Improper Access Control. The vulnerability due to leak the sentry token by changing the configured URL in the Sentry error tracking settings page. It allow an attacker to leak sentry token under specific circumstances...

Sensitive Information Disclosure

gitlab:sid is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the exposure of sensitive information which affects in GitLab versions from 10.6 before 16.1.5. This vulnerability allows the attacker to read limited information about any project's imports...

Improper Access Control

Gitlab is vulnerable to Improper Access Control. The vulnerability is caused due to improper permission validation while granting access to git lab projects. An attacker can fork a project outside of current group and can compromise the target system...

Denial Of Service (DOS)

gitlab is vulnerable to Denial Of Service. The vulnerability is due to user can bypass or skip the pagination mechanism in the projects API. Such a bypass can lead to potential Denial of Service DoS attacks on certain instances...

Unauthorized Access

GitLab is vulnerable to Unauthorized Access.The vulnerability is caused due to improper access controls. This could allows an attacker to access sensitive information within private projects,configurations, and other confidential data associated with CI/CD jobs...

Improper Neutralization Of Special Elements

gitlab is vulnerable to Improper Neutralization of Special Elements. The vulnerability is due to there is no proper validation for user-supplied input, specifically when committing directories containing LF Line Feed characters. This flaw results in HTTP 500 errors when viewing the affected commi...

Information Disclosure

GitLab is vulnerable to Information Disclosure. The vulnerability is caused due to improper error handling. This leads to a leakage of a user's email via an error message for groups that restrict membership by email domain...

Open Redirect

GitLab is vulnerable to Open Redirect vulnerability. The vulnerability is caused due to improper URL sanitization in Gitlab. This could allow an attacker to create a URL that would redirect to a different project...

Insufficient Verification Of Data Authenticity

gitlab is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to there is no checking for owner or administrator privileges while creating fork relationships between existing projects contrary to the documentation using API calls...

Code Injection

gitlab is vulnerable to Code Injection. The vulnerability is due to there is no sanitization of KaTeX directives, allowing them to escape their intended container. This allows an attacker to hijack some links and buttons on the GitLab UI to a malicious page...

Denial Of Service (DoS)

GitLab CE/EE is vulnerable to Denial Of Service DoS. The vulnerability is caused due to invalid 'startsha' value on the merge requests page in GitLab.This potentially leads to Denial Of Service DoS attack...

Denial Of Service

gitlab:sid is a vulnerable of Denial of Service. The vulnerability is due to Improper Input Validation and also affecting all versions of Gitlab EE and CE. It leads to denial of service by allow an attacker to cause pipelines to fail...

Denial Of Service

gitlab:sid is vulnerable of Denial Of Service. The vulnerability is due to by adding a large string in timeout input in gitlab-ci.yml file. It allow an attacker to effect all versions in GitLab CE/EE and leads to regular expression denial of service...

Improper Access Control

Gitlab is vulnerable to Improper Access Control. The vulnerability is caused due to a missing permission validation for a user while accessing git lab project dependencies. A user can access composer packages on public projects that have package registry disabled in the project settings...

Improper Authorization

Gitlab is vulnerable to Improper Authorization. It is possible for unauthorized users to view public project release descriptions via atom endpoint...

Insufficient Verification Of Data Authenticity

exim4 library is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to insufficient verification Exim's SMTP server configurations as it support a character sequence . in SMTP transactions, which is not universally supported by other popular email servers. This...

SMTP Smuggling

Postfix is vulnerable to SMTP smuggling. The vulnerability is caused due to support for . while handling line endings. A remote attacker can exploit this using published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection...

Arbitrary Code Execution

github.com/free5gc/amf/ is vulnerable to Arbitrary Code Execution. The vulnerability arises due to a lack of validation for invalid NGAP messages. An attacker can execute remote code and cause DoS via a crafted NGAP message...

Stored Cross Site Scripting (XSS)

WSO2 is vulnerable to Stored Cross Site Scripting XSS. The vulnerability is due to improper output encoding. This issue can be exploited by an attacker by injecting malicious JavaScript payloads into the Registry feature of the Management Console...

Improper Certificate Validation

Snowflake.data is vulnerable to Improper Certificate Validation. The vulnerability is due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. This allows an attacker with access to the private key of a correctly issued certificate to execute...

Incorrect Authorization

Nautobot is vulnerable to Missing Authorization. The vulnerability is due to a lack of proper enforcement of object-level permissions when submitting a job to run. This could allow an attacker with permissions to run only a single job to run all configured JobButton Jobs...

CSV Injection

Active Admin is vulnerable to CSV Injection. This vulnerability is due to missing sanitization while exporting a CSV file. An attacker can inject malicious data to a CSV file such as =, +, -', @, \t, \r which results in arbitrary macro execution if the csv file is opened in software such as excel...

Man-in-the-Middle (MitM)

systemd:sid is vulneranble to Man-in-the-Middle MitM. The vulnerability due to systemd-resolved accept records of DNSSEC-signed domains. It allows an attacker to manipulate records with out any signature...

Improper Authorization

gitlab is vulnerable to Improper Authorization. It is possible for a removed project member to write to protected branches by using deploy keys...

Code Injection

gitlab is vulnerable for Code Injection. The vulnerability is due to there is no validation or sanitization for branch names. this allows an attacker can bypass branch protection rules using specially crafted branch names. This flaw enabled unauthorized manipulation of repository content in the...

Arbitrary Code Execution

gitlab:sid is vulnerable to Remote code execution. The vulnerability due to perform arbitrary pipeline execution under the context of another user. It allow an attacker execute the other user context with malicious code...

Improper Authorization

Gitlab is vulnerable to Improper Authorization. It is possible for developers to override predefined CI variables via REST API in certain situations...

Code Injection

Gitlab is vulnerable to Code Injection. The vulnerability is caused due to lack of validation of file names. An attacker can inject code which can alter the representation of the UI...

Information Exposure

gitlab:sid is vulnerable to Information Exposure. The vulnerability due to read the source code of a project by using attackeraccesstoken and login to Victim account sets the Repository. It allows an attacker execute the malicious command with attacker account...

Improper Access Control

Gitlab is vulnerable to Improper access control. It is possible for a Guest user to add an emoji on confidential work items...

Information Disclosure

GitLab EE is vulnerable to Information Disclosure.The vulnerability is caused due to improper authorization. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates...

Uncontrolled Resource Consumption

gitlab is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to When GitLab imports a project containing a Tar archive, and this archive includes a FIFO file, it causes the import process to get stuck. An attacker can exploit this by creating a Tar archive containing a FIFO...

Denial Of Service

gitlab:sid is vulnerable to Denial of Service. The vulnerability due to point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop. it allows an attacker to cause Denial of Service...

Information Exposure

gitlab is vulnerable to Information Exposure. The vulnerability is due to supersidebarloggedout feature flag. When this feature flag is enabled, it may unintentionally disclose GitLab version metadata to unauthorized individuals...

Denial Of Service

gitlab:sid is vulnerable to denial of service. the vulnerability due to importing or cloning malicious content. It allows an attacker influence the amount of resources consumed, eventually leading to the exhaustion of available resources...

Denial Of Service

gitlab:sid is vulnerable to denial of service. The vulnerability due to importing or cloning malicious content while authentication. it allow an attacker to exhaustion of available resources which leads to denial of service...

Denial Of Service

fish:sid is vulnerable to Denial of service. The vulnerability due to allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. It leads to unexpected behavior with direct input and allow an attacker to execute denial of...

Directory Traversal

Asterisk is vulnerable to Directory Traversal. The vulnerability arises because it allows the reading of any arbitrary file, even when the livedangerously setting is not enabled.This allows arbitrary files to be read...

Out-of-Bounds Write

lrzip:sid is vulnerable to Out-of-Bounds Write. The vulnerability exists in lrzip v0.651 via the libzpaq::PostProcessor::writeint function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

Out-of-bounds Write

Firefox is vulnerable to Out-of-bounds Write. The vulnerability is due to improperly accessing memory which can lead to memory corruption. This issue can be exploited by an attacker to result in arbitrary code execution...