A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to execute arbitrary code with kernel privileges.

The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.5, 10.13.x prior to 10.13.6 Security Update 2020-003, 10.14.x prior to 10.14.6 Security Update 2020-003. It is, therefore, affected by multiple vulnerabilities:

  - In ksh version 20120801, a flaw was found in the way it     evaluates certain environment variables. An attacker     could use this flaw to override or bypass environment     restrictions to execute shell commands. Services and     applications that allow remote unauthenticated attackers     to provide one of those environment variables could     allow them to exploit this issue remotely.
    (CVE-2019-14868)

  - In Zsh before 5.8, attackers able to execute commands     can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the     original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that     calls setuid(). (CVE-2019-20044)

  - An out-of-bounds read was addressed with improved input     validation. This issue is fixed in iOS 13.3.1 and iPadOS     13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS     6.1.2. Processing a maliciously crafted image may lead     to arbitrary code execution. (CVE-2020-3878)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 13.5. It is, therefore, affected by multiple vulnerabilities.

Gitlab reports :

Arbitrary File Read when Moving an Issue

Path Traversal in NPM Package Registry

SSRF on Project Import

External Users Can Create Personal Snippet

Triggers Decription Can be Updated by Other Maintainers in Project

Information Disclosure on Confidential Issues Moved to Private Programs

Potential DoS in Repository Archive Download

Blocked Users Can Still Pull/Push Docker Images

Repository Mirroring not Disabled when Feature not Activated

Vulnerability Feedback Page Was Leaking Information on Vulnerabilities

Stored XSS Vulnerability in Admin Feature

Upload Feature Allowed a User to Read Unauthorized Exported Files

Unauthorized Users Are Able to See CI Metrics

Last Pipeline Status of a Merge Request Leaked

Blind SSRF on FogBugz

Update Nokogiri dependency

ID	Name	Product	Family	Severity
136930	macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003	Nessus	MacOS X Local Security Checks	high
136920	Apple iOS < 13.5 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
134963	FreeBSD : Gitlab -- Multiple Vulnerabilities (08fba28b-6f9f-11ea-bd0b-001b217b3468)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-9795

high

Tenable Plugins

high

critical

critical