Incorrect User Management in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

Low‑Privilege HTTP Exploit Allowing Unauthorized Data Modification and DoS in Oracle JD Edwards EnterpriseOne Tools

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.

Reserved in error; never associated with a vulnerability.