In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code     into pages with pagination links. This has been fixed in 1.2.1. (CVE-2020-11082)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5005 advisory.

  - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code     into pages with pagination links. This has been fixed in 1.2.1. (CVE-2020-11082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2763 advisory.

  - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code     into pages with pagination links. This has been fixed in 1.2.1. (CVE-2020-11082)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gitlab reports :

Missing Permission Check on Time Tracking

Cross-Site Scripting in PyPi Files API

Insecure Authorization Check on Private Project Security Dashboard

Cross-Site Scripting in References

Cross-Site Scripting in Group Names

Cross-Site Scripting in Blob Viewer

Cross-Site Scripting in Error Tracking

Insecure Authorisation Check on Creation and Deletion of Deploy Tokens

User Name Format Restiction Bypass

Denial of Service in Issue Comments

Cross-Site Scripting in Wiki Pages

Private Merge Request Updates Leaked via Todos

Private User Activity Leaked via API

Cross-Site Scripting in Bitbucket Import Feature

Github Project Restriction Bypass

Update PCRE Dependency

Update Kaminari Gem

Cross-Site Scripting in User Profile

Update Xterm.js

Kaminari Security Advisories :

There was a vulnerability in versions of Kaminari that would allow an attacker to inject arbitrary code into pages with pagination links.

The 1.2.1 gem including the patch has already been released.

All past released versions are affected by this vulnerability.

ID	Name	Product	Family	Severity
255302	Linux Distros Unpatched Vulnerability : CVE-2020-11082	Nessus	Misc.	medium
155293	Debian DSA-5005-1 : ruby-kaminari - security update	Nessus	Debian Local Security Checks	medium
153571	Debian DLA-2763-1 : ruby-kaminari - LTS security update	Nessus	Debian Local Security Checks	medium
138123	FreeBSD : Gitlab -- Multiple Vulnerabilities (0a305431-bc98-11ea-a051-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
136956	FreeBSD : kaminari -- potential XSS vulnerability (4e6875a2-a126-11ea-b385-08002728f74c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-11082

medium

Tenable Plugins

medium

medium

medium

high

medium