diff options
| author | Torsten Zuehlsdorff <tz@FreeBSD.org> | 2017-12-14 10:58:46 +0000 |
|---|---|---|
| committer | Torsten Zuehlsdorff <tz@FreeBSD.org> | 2017-12-14 10:58:46 +0000 |
| commit | 80412434ed0d4d028b9eee8a29aee207b28e48ae (patch) | |
| tree | 37c0d92d90532dffcdbba6c627c0c9ab2abe066e /security/vuxml | |
| parent | bdf5b3d24acef4eff34e27e0773a5a80615ac89d (diff) | |
| download | ports-80412434ed0d4d028b9eee8a29aee207b28e48ae.tar.gz ports-80412434ed0d4d028b9eee8a29aee207b28e48ae.zip | |
Notes
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e78e51e703bd..0bd3659566e2 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b"> + <topic>GitLab -- multiple vulnerabilities</topic> + <affects> + <package> + <name>gitlab</name> + <range><ge>4.2.0</ge><le>10.0.6</le></range> + <range><ge>10.1.0</ge><le>10.1.4</le></range> + <range><ge>10.2.0</ge><le>10.2.3</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>GitLab reports:</p> + <blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/"> + <h1>User without access to private Wiki can see it on the project page</h1> + <p>Matthias Burtscher reported that it was possible for a user to see a + private Wiki on the project page without having the corresponding + permission.</p> + <h1>E-mail address disclosure through member search fields</h1> + <p>Hugo Geoffroy reported via HackerOne that it was possible to find out the + full e-mail address of any user by brute-forcing the member search + field.</p> + <h1>Groups API leaks private projects</h1> + <p>An internal code review discovered that users were able to list private + projects they had no access to by using the Groups API.</p> + <h1>Cross-Site Scripting (XSS) possible by editing a comment</h1> + <p>Sylvain Heiniger reported via HackerOne that it was possible for + arbitrary JavaScript code to be executed when editing a comment.</p> + <h1>Issue API allows any user to create a new issue even when issues are + restricted or disabled</h1> + <p>Mohammad Hasbini reported that any user could create a new issues in a + project even when issues were disabled or restricted to team members in the + project settings.</p> + </blockquote> + </body> + </description> + <references> + <url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url> + </references> + <dates> + <discovery>2017-12-08</discovery> + <entry>2017-12-14</entry> + </dates> + </vuln> + <vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2"> <topic>tor -- Use-after-free in onion service v2</topic> <affects> |