A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Gitlab reports :

Missing Permission Check on Time Tracking

Cross-Site Scripting in PyPi Files API

Insecure Authorization Check on Private Project Security Dashboard

Cross-Site Scripting in References

Cross-Site Scripting in Group Names

Cross-Site Scripting in Blob Viewer

Cross-Site Scripting in Error Tracking

Insecure Authorisation Check on Creation and Deletion of Deploy Tokens

User Name Format Restiction Bypass

Denial of Service in Issue Comments

Cross-Site Scripting in Wiki Pages

Private Merge Request Updates Leaked via Todos

Private User Activity Leaked via API

Cross-Site Scripting in Bitbucket Import Feature

Github Project Restriction Bypass

Update PCRE Dependency

Update Kaminari Gem

Cross-Site Scripting in User Profile

Update Xterm.js

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2551 advisory.

  - xterm.js: Mishandling of special characters allows for remote code execution (CVE-2019-0542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2552 advisory.

  - xterm.js: Mishandling of special characters allows for remote code execution (CVE-2019-0542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for atomic-openshift-web-console is now available for Red Hat Openshift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

The atomic-openshift-web-console package provides the management console for OpenShift Container Platform.

Security Fix(es) :

* xterm.js: Mishandling of special characters allows for code execution (CVE-2019-0542)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ID	Name	Product	Family	Severity
138123	FreeBSD : Gitlab -- Multiple Vulnerabilities (0a305431-bc98-11ea-a051-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
128515	RHEL 7 : OpenShift Container Platform 3.9 atomic-openshift-web-console (RHSA-2019:2551)	Nessus	Red Hat Local Security Checks	high
128069	RHEL 7 : OpenShift Container Platform 3.10 atomic-openshift-web-console (RHSA-2019:2552)	Nessus	Red Hat Local Security Checks	high
125805	RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift-web-console (RHSA-2019:1422)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-0542

high

Tenable Plugins

high

high

high

high