Writeup Exploits
68,147 exploits tracked across all sources.
GitLab < 12.2.1 - Information Disclosure via Markdown Embedded Media
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.
CVSS 5.3
GitLab 12.0-12.2.1 - Authorization Bypass via Epic Notes API
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information.
CVSS 7.5
GitLab 11.10.0-12.2.1 - Cross-Site Scripting in Label Descriptions
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.
CVSS 6.1
GitLab 11.9.4-11.10.1 - Missing Authorization via Merge Request Email Creation
An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations.
CVSS 5.3
GitLab 8.15.0-12.2.1 - Denial of Service via Markdown Mathematical Expression Parsing
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.
CVSS 7.5
GitLab 10.8.0-12.2.1 - Authenticated Incorrect Permission Assignment for Critical Resource via Internal Endpoint
An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings.
CVSS 5.4
GitLab 12.0-12.1.4 - Use of Hard-coded Credentials
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.
CVSS 9.8
JFinal < 4.4 and com.jfinal < 4.5 - Unrestricted Upload of File with Dangerous Type via isSafeFile Bypass
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.
CVSS 7.5
Technicolor TC7300.b0_firmware - Stored Cross-Site Scripting via FTPDiag.asp FileName Parameter
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp.
CVSS 5.4
Technicolor TC7300.b0_firmware STFA.51.20 - Cross-Site Scripting via Connected Clients Field
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this.
CVSS 5.4
ReportLab < 3.5.26 - Remote Code Execution via toColor eval Injection
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
CVSS 9.8
DAViCal < 1.1.8 - Reflected Cross-Site Scripting via Action Parameter
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
CVSS 9.3
DAViCal < 1.1.8 - Cross-Site Request Forgery
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
CVSS 8.8
DAViCal <= 1.1.8 - Stored Cross-Site Scripting via User Profile Fields
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
CVSS 5.4
Electronic Logbook 3.1.4 - Cross-Site Scripting via Localization Value Parameter
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
CVSS 6.1
Electronic Logbook 3.1.4 - Cross-Site Scripting via SVG Document
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
CVSS 6.1
GitLab 11.11.0-11.11.6 - Stored Cross-Site Scripting in Email Notification Feature
An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
CVSS 5.4
GitLab 11.11.0-11.11.6 - Server-Side Request Forgery via GitHub Integration
An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
CVSS 3.5
libtiff 4.0.10 - Memory Leak in TIFFFdOpen
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
CVSS 8.8
libtiff 4.0.10 - Denial of Service via TIFFWriteDirectoryTagTransferfunction
An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.
CVSS 6.5
GitLab <11.6.10-11.8.1 - Info Disclosure
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
CVSS 9.1
GitLab <11.7.7, <11.8.3 - Info Disclosure
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure.
CVSS 6.5
GitLab Community and Enterprise Edition <11.6.10/11.7.6 - Incorrect Access Control
An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.
CVSS 9.8
GitLab <11.6.10-11.8.1 - Incorrect Access Control
An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
CVSS 9.8
GitLab <11.6.10-11.8.1 - Info Disclosure
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
CVSS 9.8
By Source