GitHub: RC Between GitHub’s Repo Transfer REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the trans ...

Continue Reading
GitLab < 15.6.7 (SECURITY-RELEASE-GITLAB-15-8-1-RELEASED)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before ...

Continue Reading
Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components (e.g., framework libraries) that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details ...

Continue Reading
GitLab 13.8 < 13.9.7 / 13.10 < 13.10.4 / 13.11 < 13.11.2 (CVE-2021-22209)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not ...

Continue Reading
GitLab 13.0 < 14.3.6 / 14.4 < 14.4.4 / 14.5 < 14.5.2 (CVE-2021-39915)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 ...

Continue Reading
CVE-2023-6690

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the trans ...

Continue Reading
Cache poisoning in drupal/core

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, lea ...

Continue Reading
CVE-2023-26144

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large qu ...

Continue Reading

Back to Main

Subscribe for the latest news: