Archive
4 November 2021
Vulnerabilities first published on this day (UTC), newest first.
67 results · Feed
-
Low 3.7
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may a…
-
Medium 4.3
An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic informat…
-
Low 1.7
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting…
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data fro…
-
Medium 4.3
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 1…
-
Medium 6.0
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project…
-
High 7.7
A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13…
-
Low 2.7
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiti…
-
Medium 4.4
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all vers…
-
Low 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a proj…
-
Medium 5.3
A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images …
-
High 8.7CVE-2021-39906 EPSS 61%
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaS…
-
Medium 5.3
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 …
-
Medium 6.5
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility l…
-
Medium 4.3
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the se…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
High 7.8
Obsidian Dataview vulnerable to code injection due to unsafe eval
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for …
-
High 7.1
XSS vulnerability in GraphiQL
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than graphiql@1.4.7 are vulnerable to compromised HTTP schema introspection responses or schema prop value…
-
Unscored —
Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation be…
-
High 7.1
XSS vulnerability in GraphQL Playground
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values wi…
-
Unscored —
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurio…
-
Unscored —
EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to…
-
Unscored —
An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…
-
Unscored —
Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform netwo…
-
Unscored —
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's …
-
Low 3.5
incomplete logout in JupyterHub
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-us…
-
Medium 6.5
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
-
Critical 9.1
Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
-
High 8.8
Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library w…
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#co…
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.
-
Critical 9.0
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
-
Critical —
Embedded malware in rc
The npm package `rc` had versions published with malicious code. Users of affected versions (1.2.9, 1.3.9, and 2.3.9) should downgrade to 1.2.8 as soon as possible and check their systems for suspicious activity. Any computer that has this package installed o…