A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Gitlab reports :

Missing Permission Check on Time Tracking

Cross-Site Scripting in PyPi Files API

Insecure Authorization Check on Private Project Security Dashboard

Cross-Site Scripting in References

Cross-Site Scripting in Group Names

Cross-Site Scripting in Blob Viewer

Cross-Site Scripting in Error Tracking

Insecure Authorisation Check on Creation and Deletion of Deploy Tokens

User Name Format Restiction Bypass

Denial of Service in Issue Comments

Cross-Site Scripting in Wiki Pages

Private Merge Request Updates Leaked via Todos

Private User Activity Leaked via API

Cross-Site Scripting in Bitbucket Import Feature

Github Project Restriction Bypass

Update PCRE Dependency

Update Kaminari Gem

Cross-Site Scripting in User Profile

Update Xterm.js

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2551 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private cloud deployments.

    Security Fix(es):

    * xterm.js: Mishandling of special characters allows for remote code execution (CVE-2019-0542)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2552 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * xterm.js: Mishandling of special characters allows for remote code execution (CVE-2019-0542)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1422 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes     application platform solution designed for on-premise or private cloud     deployments.

    The atomic-openshift-web-console package provides the management console for OpenShift Container Platform.

    Security Fix(es):

    * xterm.js: Mishandling of special characters allows for code execution (CVE-2019-0542)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
138123	FreeBSD : Gitlab -- Multiple Vulnerabilities (0a305431-bc98-11ea-a051-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
128515	RHEL 7 : OpenShift Container Platform 3.9 atomic-openshift-web-console (RHSA-2019:2551)	Nessus	Red Hat Local Security Checks	high
128069	RHEL 7 : OpenShift Container Platform 3.10 atomic-openshift-web-console (RHSA-2019:2552)	Nessus	Red Hat Local Security Checks	high
125805	RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift-web-console (RHSA-2019:1422)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-0542

high

Tenable Plugins

high

high

high

high