DELTA 505958 0 44855 SVN/Z.;!a;9i @@UPmUx^K0r .PF(`&lWpK4GAh~?Im4;'[+RJVQucnxt:%/nAe&SR!\Z5=B Nݞ`oF[8΅ ³=,@/<-E9>B.>JW}5/2:G)A" :C 9aw?C=A vid="da459dbc-5586-11e9-abd69.011.9.4 11.8.011.8.6 11.7.1Gitlab reports:

DoS potential for regex in CI/CD refs

Related branches visible in issues for guests

Persistent XSS at merge request resolve conflicts

Improper authorization cont C=Cx^N0 ):TLV ظNIޞCBbK,l5j/=!Hŕ o~k] ; zaIz+6p4IDv~GIJxZ{- ȾHbI弄J33آȓVrl(FcxPR&y /)(ڷƮƶZY-?758poURc̐*zU>Vvr=x-d224-11e8-9623-a4badb2f4699"> libsshlibssh 0.60.7.6 0.80.8.4gladiac reports:

libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the serve]q9w,=[>

Markdown DoS

Information Disclosure Prometheus Metrics

CSRF in System Hooks

Persistent XSS Pipeline Tooltip

Persistent XSS in Br zC=Cx^N0 3<_ #k˄i;lЭjH*)=)`a>XeKPhm O Uȃ0.+70M͕zG[{ -Ղ $CY.!=QvBZT:Hh(2aGoXl;X@Ȭ(_-SL6Н-*!65~?+ http://tomcat.apache.org/security-7.html CVE-2018-1304 CVE-2018-1305 2018-02-23 2018-02-23 u UAPgv )zuEc#m~hPk>doԗQ&lMD>뢪 \\d#}2dd5)wXF:Z>w֠24=ޝc7:L#`NCM3<t)e"ݶ"[YB$ȗ%de(MSj~sJ߭ g 0eN#>,!mƋ꺘߬/Z̯V2NIo7v@=Mx^]Mo0 ɯ Li swN8+';nD:|)~=khRBUB=jySh99Z08­*UEYl( z[(Ty)+Z͵8t6 d>.GaJv &YhB9dR4d8}/ԡ9B{CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5390 CVE-2017-5391 CVE-2017-5392 CVE-2017-5393 CVE-2017-5394 CVE-2017-5395 CVE-2017-53967-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/$=|x^MO0 ۯ8uۡ~LU%8pؕ{Eڔ$ؿ'"[ojxV^kmd:h8JLAC^1V qAQd](YQǞIq?P'O9kSǎ!hm7HNF%$j>y߻"0-иɹA:Lˬ±u}pFH+8Lp,Zz  ,%}-r2- {?ٲѠ8Ou(Flaws in libarchive's handling of symlinks and hard links allow overwriting files outside the extraction directory, or permission changes to a directory outside the extraction directory.

Impact:

An attacker who can control freebsd-update's or portsnap's input to tar(1) can change file content or permissions on files outside of the update tool's working sandboxSt@Q<$"x^eQKK1>m A,HţdI3lkov[u[k/>fR,:x,E7QW>$>~ d)9sg+:$ҹ^f"uQH"&uAZBϠjD%TPr(ȉ"1}=/׺"34t nD/ sD !%AK\Bϱd W0e!G Ϡ "̘‘*#Zie a!RD5_|1)vQ`j; N+GEiAM62m]]uB $uw(Y=s dnsmasq 2.76,1 dnsmasq-devel 2.76.0test reports:

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locallylists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016 uC=Cx^}AR0 E)f P 0plXv~]bK?}8ʒq+27$BmH9Jh+?nLu$( :ɭ*N#eEt/9o9YOYx뾇v4#p^䴂#lB^f4G{5:XO5v)a,K7Teh]jtAX7*=kx^}0 SXwe$@7!WONMNcgz;~q.ĎF!~|9}8<}<~꥾LeN?˷P +&IW ^Cy y#!Vk*$-֐ΚS[xolY%~U9qJf+:[0n I@:"֐,YSh|[xЩU tOF3G{5_\t%luն,N0"mMŽxߗAYIOn nS8xC[i|G;ktPm=ՀQAM:4jYJ =yx^j0Sq?PJPhw8"JrB޾r|ۙ$ GO@M^p.ЊIyuͺނBӖR=q촁ۓRPu%faӛ^ͽymYb̦2XGi oZȰRFK 0Xum`#lQ=.ju5OR|Q wbk.SҸ/< Ɲ!*-,AJf|gՉ;RwZ,aarðcF OA^ZC}=M/stable-channel-update_152-16 2015-12-18

Cups Filters/Foomatic Filters does not c*K/N1c=(Fixed an XSS attack vector in Security Library method xss_clean().

Changed Config Library method base_url() to fallback to ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header injections.

Changed CAPTCHA Helper to try to use the operating system's PRNG firstfreebsdpr>ports/2034035-10-31 2015-11-01

  • Core:
    • Fixed bug #70172 (Use After Free Vulnerability in unserialize()).
    • Fixed bug #70219 (Use after free vulnerability in session deserializer). 2015-06-23bfda05f-2e6f-11e5-a4a5-002590263bf5"> cacti -- Multiple XSS and SQL injection vulnerabilities cacti 0.8.8eThe Cacti Group, Inc. reports:

      Important Security Fixes

      • Multiple XSS and SQL injection vulnerabilities
      • CVE-2015-4634 - SQL injection in graphRcN?^2lq#*Pd">

        SSLv3 is no longer supported; TLS 1.0+ is required (compatible with Logstash 1.4.2+)!-- POODLE CVE pending --> ports/201065 ports/201065 https://www.elastic.co/blog/logstash-1-4-3-released https://www.elastic.co/blog/logstash-forwarder-0-4-0-released 2015-06-24 e=jx^n SZJi%˴GXC %%a#ZҶr6~?bMHH5Z;e99W&gSanxLw:wQؽTܠMC8D7FHq|J(h)()e>yYiN+DŽRr tx1TP\-6\$Y뚰ezo*(:S(KC KpmFMFTS,X^pN ,'\&v_>[W~U4\v@JsZffects> firefox 33.0,1 firefox-esr 31.2.0,1 linux-firefox 333031.23031.2.0 libxul 31.2.0&%\m`'^+ZX@u<%>firefox-esr 24.5965.0 seamonkey 2.265 C=Cx^ 0 E] 1mJO»ed$t$}{?SF0;L YNm>|W0G__;AҞBq o 2013-06-26 ױYm̰|hm={˷ ,= (C . iHs*o 8U篫 rU \ HTgX)`rBu z-uťZ\o=UF;`rVco6f TH=O 鎶V3t:l'0[@]b~ [M?[rm [t3PC}y69ykZZP< ;MҼzco#[L+ݝw" hK3WQ&Ǯ_V<Q@TxtJ?=Td to execution of commands, because of shell expansions.

        Workaround with a non-patched version: remove/unload all scripts calling function hook_process (for maximum safety)64 2012-11-15 2012-11-18 2012-11-18 bugzillabugzilla 3.6.0]$}7,M3'!ɞrxA ,vneyA &\K샮JiP l+]B&aW>*&I'O$/T UE q.G갥trv>Q}(a~أ5!&?J5Π rC=Cx^AO0Ϗ_noRA&B!.g;NK=vDNF93."wTs!FMsU?t0I1Dǐx-`x+x^<7=y$wsU>WTWJ@-ANAxw%㤬d(c°8gtPn,7smd֤Nr 6WYfUtwCUHCFںV,YߕgVKD7iLTRz2Xdzj [ȾOW&'K-&|+G̨u%ਏ6͚V1I: _F; a'BxC1nW&{};p׈tfY(v?=me>CVE-2011-4619 CVE-2012-0027 http://openssl.org/news/secadv_2012010414 isc-dhcp-server -- DoS in DHCPv62ISC reports:

        Due to improper handling of a DHCPv6 lease struc.L4V>|Abx^UOo ϻbS"]QWjC/=$U,mV?؛MUNcx@O@Q//}Q,|Ln я#[!ͬqwN.OA K@1l L?Y3)H5ÑJq9)!SX\z4[gRXF(8/V̦kc2r9D4!F\vR/!$nLW̥T3>,aUUyϓϒ3<-g8@|􉴱Q+{ ^Ũ0z s tc=c:L.pK#|`xӽnVRLѼ48ԭ. %&Lۭg}CYeUsqB/-WqVP8Nhttp://www.mozilla.org/security/announce/2010/mfsa2010-575859606162638 2010-09-15 Xlwv5j=V linux-firefox 3.0.18,1 linux-firefox-devel 3.5.8 seamonkey 2.0.*2.0.3 thunderbird 3.03.0.10-05 XSS hazard using SVG document and binary Content-Type

        MFSA 2010-04 XSS due to window.dialol7N>=ux^uRAr <ǯy1XNb;꾯BbdOb\(,nzBĴ atfI2S|/,wj'jDm!4b 7 http://www.rapid7.com/advisories/R7-0033.jsp 2008-07-25 2009-03-11 pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability pngcrush 1.6.143976/">

        A vulnerability hasMI7\_?=x^eOO1)&af AFvN.iy7of@0>R:1F2D >&@Lp2 (鲢ڝ -)=z%-!$ http://milw0rm.com/exploits/6032 2008-07-07 2008-07-09 py-pylons -- Path traversal bug py24-pylons 0.9.6.2)N@_=ux^N@ )-U B􌄀qUqM&-BBHi3x7$80l^{GTpd3`d@QJufZ(hԊR E,={d"}Q595'h} `,Xw^9ٹhأ_iG9n. 0^Er5\mJCK b\.hfٞ7CX2 #j:j0˼X.M*v #[m7db Їi4-4zl~"NS=ux^MQr `},Z*/ZcΦ8KtG6q^PTOzle=G^螔pܤ0/OՈ߷v\7R&EB='"۾ojS;K_͓_荇q 1p]_wn-?Qq(Rs~=Px^Pv0 +t:8fdT~@ID"pT)7h9p:՛}Hܲ%bC|mE6!{P4}VZt2sNZ,xgzt` wZ6uoF z@f 5yţ hcn: Ap%'zV*:y:Dm5i%ب޹q#@Pp׻:ot_N@]m>@h)=rry> dokudokuwiki 20060309c909819/">

        rgod has discovered a vulnerability in DokuInput passed to the "TARGET_FN" parameter in b y~IKN?6a/v`0|Aw on the Windows platform, and remote files from Windows shared folderscvename>CVE-2006-0872 CVE-2006-0873 http://retrogod.altervista.org/cpg_143_adv.html http://secunia.com/advisories/189415-22 phpmyadmin -- XSRFkUx&b;n=ilow kdegraphics 3.5.1The KDE team reports:

        kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a heap based buffer overflow in the splash rasterizer engine that can crash kpdf or even execute arbitrary6-0301 http://www.kde.org/info/security/advisory-20060202-1.txt  b4o Sj firefox & mozilla -- command line URL shell command injection firefox 1.0.72,2 1.8.*,2_1p OBT*NVqؓƪ=j8IwOOk4 ZF+5싢̫U.oޗMs /H^ Q[*=z Y袍e8p4a#pZ# H 5.I dF* |Y~+ d)B`OhQrޱNoڑ:_BiiFp^"gM{m;5/1qvVɦ.nvu6WZLdPs>)Jb3|&<)pF]>)=zCj7M<|2^nRLI#) ZgKڢlinux-jdkPluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system.

        The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicious jar file in order to overwrite arbitrary files within the filesystemŀ}vR3,={ackage> pdftohtml 0.36_2An iDEFENSE Security Advisory608898221554">

        Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer included in multiple Unix and Linux distributions could allow for arbitrary code execution as the user viewing a PDF file.

        The vulnerability specifically exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. The ˠW0v~mP@ x^MPN0<_J&B7XMu{씗%K;3)ע\r r1|Vs:zcKZJQorb`$@s<95nkk-EYmW$M+@yeyAJطUq-iHG]G}73HPLпlgktI_- V%u#[6M$01)wG$g] ](dua1`zl zI2qz',6ćt&[fu m5;G|? (===According to the Mozilla project:

        An attacker who could lure users into clicking in pwK;qr@Pmsx^mQn ]gš]+6M(\{`p{4_I"sG4x; ׊ޤx 'C~tPhp}IIIUAPS}`R\.!nc{~Q,?pֽŞ`1k63ViTv? 8 Yp'pI R'?:9r]6'eL?؛k8!o}FN%ML0{xn \P4/o:HSƜ:NSQǬyIZ http://lists.samba.org/archive/rsync-announce/2003/000011.html http://rsync.samba.org/#security 2003-12-043388eff9-5d6e-11d8-80e3-0020ed76ef5a"> Samba 3.0.x password initialization bug samba 3.0,13.0.1_2,1