Archive
23 August 2021
Vulnerabilities first published on this day (UTC), newest first.
15 results · Clear filters · Feed
-
Medium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a us…
-
Medium 5.3
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized us…
-
Medium —
CKEditor 4 vulnerabilities in versions <4.16.1
Details see: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advis…
-
Medium —
Argo Server TLS requests could be forged by attacker with network access
### Impact We are not aware of any exploits. This is a pro-active fix. Impacted: * You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless). * The attacker is with…
-
Medium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to …
-
Medium 6.5
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to acces…
-
Medium 4.9
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary a…
-
Medium 6.5
XStream can cause a Denial of Service
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting …
-
Medium 5.6
IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which crea…
-
Medium 5.9
IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen…
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.6
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in all versions of F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful …