Category
Web / CMS
26,784 known vulnerabilities.
840 results · Clear filters · Feed
-
Low 3.8
In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersona…
-
Low 2.2
Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim'…
-
Low 3.7
Magento Commerce information disclosure during upload action leveraging a specially crafted file
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of do…
-
Low 3.1
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a rep…
-
Low 2.7
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages i…
-
Low 3.1
Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE…
-
Low 3.5
A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject acces…
-
Low 3.5
HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
-
Low 2.6
All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and al…
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under …
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS…
-
Low 2.4
An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possibl…
-
Low 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist whe…
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able t…
-
Low 3.5
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS…
-
Low 3.1
Support bundles can include user session IDs in Jenkins Support Core Plugin
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configuratio…
-
Low 3.1
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics st…
-
Low 3.7
XML External Entity in Dashboard Widget
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possibl…
-
Low 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab insta…
-
Low 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to p…
-
Low 2.7
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API w…
-
Low 3.7
Document root path disclosure on Maintenance page
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able t…
-
Low 2.7
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized ch…
-
Low 3.3
Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Password stored in plain text by Jenkins AppSpider Plugin
Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Access token stored in plain text by Jenkins SMS Notification Plugin
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Password stored in plain text by Jenkins couchdb-statistics Plugin
Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 2.7
An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current us…
-
Low 2.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentica…
-
Low 3.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating projec…
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not …
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be ab…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab wa…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was e…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secre…
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a…
-
Low 3.3
Credentials stored in plain text by Jenkins tfs Plugin
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
-
Low 3.3
Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
-
Low 3.1
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access …