Archive
5 October 2021
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
Medium 5.4
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may b…
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by…
-
Medium 5.3
In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or pu…
-
Medium 4.3
In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a pr…
-
Medium 5.3
In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information ab…
-
Medium 4.3
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all …
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without aut…
-
Medium 5.8
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allow…
-
Unscored —
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor f…
-
Unscored —
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binar…
-
Unscored —
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php.…
-
Unscored —
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binar…
-
Unscored —
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activit…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allow…
-
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021 -
Unscored —CVE-2021-41524 EPSS 26%
null pointer dereference in h2 fuzzing
While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49…