Archive
19 June 2020
Vulnerabilities first published on this day (UTC), newest first.
193 results · Feed
-
High 7.5
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 1…
-
Medium 5.3
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to vie…
-
Medium 5.3
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Ama…
-
Medium 6.1
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially craf…
-
High 8.0
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later…
-
High 7.5
A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts…
-
High 7.5
A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
-
Medium 4.3
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
-
High 7.5
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authoriz…
-
High 7.4
User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/…
-
Unscored —
A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to…
-
Unscored —CVE-2020-14930 Public exploit
An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-re…
-
High 8.8
WooCommerce Cross-Site Request Forgery (CSRF)
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
-
Unscored —
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory con…
-
Medium 6.1
Mattermost Server allows XSS via CSRF
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
-
Medium 6.1
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through crafted links
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
-
Medium 4.3
Mattermost Server exposes information stored by a web browser
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
-
Medium —
Mattermost Server exposes account details to any Team Administrator
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
-
Medium 6.1
Mattermost Server allows XSS via redirect URL
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
-
Medium 6.5
Mattermost Server exposes sensitive information via its System Console UI
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
-
Low 2.7
Mattermost Server allows System Admin to modify LDAP account names and email addresses
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
-
High 7.5
Mattermost Server does not check if cookies are used over SSL
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
-
Medium 5.3
Mattermost Server exposes sensitive information about team URLs via an API
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
-
High —
Mattermost Server: Insufficient Password-Reset Link Invalidation
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
-
Medium 6.1
Mattermost Server is vulnerable to XSS via a Legal or Support setting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
-
Medium 6.5
Mattermost Server's Session ID and Session Token are potentially compromised
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
-
Medium 5.4
Mattermost Server is vulnerable to XSS through customizable theme color-code values
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
-
High 7.5
Mattermost Server does not enforce rate limits on password change attempts
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
-
Medium 5.3
Mattermost Server is vulnerable to Code Injection through its LDAP fields
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
-
Medium 5.3
Mattermost Server is vulnerable to Uncontrolled Resource Consumption
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
-
High 7.5
Mattermost Server: initial_load API exposes unnecessary information
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
-
High 7.1
Information Exposure in jaeger
Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
-
Unscored —
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up m…
-
Unscored —
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
-
Medium 6.1
Mattermost Server vulnerable to Cross-site Scripting through file preview feature
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
-
Unscored —
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
-
Unscored —
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
-
Unscored —
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.