Archive
4 November 2021
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 4.3
An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic informat…
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data fro…
-
Medium 4.3
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 1…
-
Medium 6.0
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project…
-
Medium 4.4
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all vers…
-
Medium 5.3
A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images …
-
Medium 5.3
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 …
-
Medium 6.5
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility l…
-
Medium 4.3
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the se…
-
Medium 6.5
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
-
Medium 5.4
Cisco Webex Video Mesh Arbitrary Site Redirection Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP…
-
Medium 4.3
Cisco Unified Communications Products Path Traversal Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unifi…
-
Medium 4.8
Cisco Prime Access Registrar Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability exists because the web-based manageme…
-
Medium 5.4
Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user o…
-
Medium 4.3
Cisco Umbrella Email Enumeration Vulnerability
A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This vulnerability is due to an overly descriptive error message on the dash…
-
Medium 6.7
Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Privilege Escalation Vulnerability
A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to incorrect privilege assig…
-
Medium 6.5
Cisco Small Business RV Series Routers Command Injection Vulnerability
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system and execute …
-
Medium 6.1
Cisco Webex Video Mesh Cross-Site Scripting Vulnerability
A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-ba…
-
Medium 4.9
Cisco Common Services Platform Collector Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not s…
-
Medium 6.5
Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (U…
-
Medium 5.3
Cisco Webex Meetings Email Content Injection Vulnerability
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient…
-
Medium 5.3
Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote at…
-
Medium 6.5
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.