Archive
5 October 2021
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 4.3
Bounds check missing for decimal args in Vyper
Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.
-
Medium 4.3
BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known
BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >= 1.14.2, >= 2.4.0, >= 2.5.0 contain Use of Multiple Resources with Duplicate Identifier (CWE-694). For more information…
-
Medium 6.5
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zeph…
-
Medium 4.8
HTTP Host Header Injection in Request Handling in Typo3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example,…
-
Medium 6.5
apollo_upload_server has Denial of Service vulnerability
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny a…
-
Medium 4.3
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
-
Medium 5.4
Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting f…
-
Medium 6.8
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting f…
-
Medium 4.3
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint …
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import ena…
-
Medium 5.9
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are…
-
Medium 5.4
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project ac…
-
Medium 6.5
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired …
-
Medium 5.4
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may b…
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by…
-
Medium 5.3
In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or pu…
-
Medium 4.3
In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a pr…
-
Medium 5.3
In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information ab…
-
Medium 4.3
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all …
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without aut…
-
Medium 5.8
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allow…