Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22190 State: PUBLISHED Published: 2021-04-12T14:31:04 Last Updated: 2024-08-03T18:37:18.205Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper handling of url encoding (hex encoding) in GitLab Description: A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/300281 - https://hackerone.com/reports/1040786 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22190.json
CVE ID: CVE-2021-22191 State: PUBLISHED Published: 2021-03-15T17:48:04 Last Updated: 2024-08-03T18:37:18.230Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: External control of file name or path in Wireshark Description: Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-03.html - https://gitlab.com/wireshark/wireshark/-/issues/17232 - https://gitlab.com/gitlab-org/cves/-/blob/master/2
021-03.html - https://gitlab.com/wireshark/wireshark/-/issues/17232 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22191.json - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.gentoo.org/glsa/202107-21 - https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE ID: CVE-2021-22192 State: PUBLISHED Published: 2021-03-24T16:36:47 Last Updated: 2024-08-03T18:37:17.341Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper control of generation of code ('code injection') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/324452 - https://hackerone.com/reports/1125425 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CV
itlab/-/issues/324452 - https://hackerone.com/reports/1125425 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22192.json
CVE ID: CVE-2021-22193 State: PUBLISHED Published: 2021-03-24T16:57:47 Last Updated: 2024-08-03T18:37:18.311Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/12560 - https://hackerone.com/reports/605608 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-2219
ssues/12560 - https://hackerone.com/reports/605608 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22193.json
CVE ID: CVE-2021-22194 State: PUBLISHED Published: 2021-03-26T19:08:16 Last Updated: 2024-08-03T18:37:18.118Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Insecure storage of sensitive information in GitLab Description: In all versions of GitLab, marshalled session keys were being stored in Redis. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/262107 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22194.json
CVE ID: CVE-2021-22195 State: PUBLISHED Published: 2021-04-01T17:36:21 Last Updated: 2024-08-03T18:37:18.301Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: GitLab Products: gitlab-vscode-extension Problem Types: Improper neutralization of special elements used in a command ('command injection') in gitlab-vscode-extension Description: Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/325 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22195.json
CVE ID: CVE-2021-22196 State: PUBLISHED Published: 2021-04-02T16:14:37 Last Updated: 2024-08-03T18:37:17.698Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/254710 - https://hackerone.com/reports/977697 -
Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/254710 - https://hackerone.com/reports/977697 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22196.json
CVE ID: CVE-2021-22197 State: PUBLISHED Published: 2021-04-02T16:21:24 Last Updated: 2024-08-03T18:37:17.487Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/323198 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-2
https://gitlab.com/gitlab-org/gitlab/-/issues/323198 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22197.json
CVE ID: CVE-2021-22198 State: PUBLISHED Published: 2021-04-02T16:20:10 Last Updated: 2024-08-03T18:37:17.882Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/323452 - https://hackerone.com/reports/1107281 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22198.json
CVE ID: CVE-2021-22199 State: PUBLISHED Published: 2021-04-22T21:56:00 Last Updated: 2024-08-03T18:37:18.257Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/291004 - https://hackerone.com/reports/1050189 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CV
itlab/-/issues/291004 - https://hackerone.com/reports/1050189 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22199.json
CVE ID: CVE-2021-22200 State: PUBLISHED Published: 2021-04-02T16:22:37 Last Updated: 2024-08-03T18:37:18.276Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/247523 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22200.json
CVE ID: CVE-2021-22201 State: PUBLISHED Published: 2021-04-02T16:17:40 Last Updated: 2024-08-03T18:37:18.224Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/325562 - https://hackerone.com/reports/1132378 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22201.json
CVE ID: CVE-2021-22202 State: PUBLISHED Published: 2021-04-02T16:25:43 Last Updated: 2024-08-03T18:37:18.190Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Cross-site request forgery (csrf) in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/26017 - https://hackerone.com/reports/471274 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22202.json
CVE ID: CVE-2021-22203 State: PUBLISHED Published: 2021-04-02T16:16:15 Last Updated: 2024-08-03T18:37:17.326Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/320919 - https://hackeron
st Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/320919 - https://hackerone.com/reports/1098793 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22203.json
CVE ID: CVE-2021-22204 State: PUBLISHED Published: 2021-04-23T17:22:15.000Z Last Updated: 2025-10-21T23:25:48.455Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: ExifTool Products: ExifTool Problem Types: Improper neutralization of directives in dynamically evaluated code ('eval injection') in ExifTool Description: Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d1
hment: References: - https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 - https://hackerone.com/reports/1154542 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json - https://www.debian.org/security/2021/dsa-4910 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
TBBR66OOPXSXCG2PQRM5KCZL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ - http://www.openwall.com/lists/oss-security/2021/05/09/1 - http://www.openwall.com/lists/oss-security/2021/05/10/5 - http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html - https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html - http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html - http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-
4/GitLab-13.10.2-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
CVE ID: CVE-2021-22205 State: PUBLISHED Published: 2021-04-23T17:39:36.000Z Last Updated: 2025-10-21T23:25:48.290Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper control of generation of code ('code injection') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1154542 - https://gitlab.com/gitlab-org/gitlab/
er: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1154542 - https://gitlab.com/gitlab-org/gitlab/-/issues/327121 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json - http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html - http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
CVE ID: CVE-2021-22206 State: PUBLISHED Published: 2021-05-06T13:25:10 Last Updated: 2024-08-03T18:37:18.443Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Cleartext storage of sensitive information in memory in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text, Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/230864 - https://hackerone.com/reports/928074 - https://gitlab.com/gitlab-org/cves/-
tlab.com/gitlab-org/gitlab/-/issues/230864 - https://hackerone.com/reports/928074 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22206.json
CVE ID: CVE-2021-22207 State: PUBLISHED Published: 2021-04-23T17:32:51 Last Updated: 2024-08-03T18:37:18.330Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Uncontrolled memory allocation in Wireshark Description: Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-04.html - https://gitlab.com/wireshark/wireshark/-/issues/17331 - https://gitlab.com/gitlab-org/cves/-/blob/ma
-sec-2021-04.html - https://gitlab.com/wireshark/wireshark/-/issues/17331 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22207.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NL7ZTMMWIEPHHFK3ONRKATWE7CLIGLFD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIWWO27HV4HUKXV6NH6ULHCRAQB26DMD/ - https://security.gentoo.org/glsa/202107-21 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.debian.org/security/2021/dsa-5019 - https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
CVE ID: CVE-2021-22208 State: PUBLISHED Published: 2021-05-06T13:35:17 Last Updated: 2024-08-03T18:37:18.290Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Missing authorization in GitLab Description: An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/301212 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22208.json
CVE ID: CVE-2021-22209 State: PUBLISHED Published: 2021-05-06T13:37:47 Last Updated: 2024-08-03T18:37:18.262Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/327155 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22209.json
CVE ID: CVE-2021-22210 State: PUBLISHED Published: 2021-05-06T13:19:32 Last Updated: 2024-08-03T18:37:17.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Allocation of resources without limits or throttling in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/322500 - https://gitlab.com/gitlab-org/cves/-/blob/master
r: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/322500 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22210.json
CVE ID: CVE-2021-22211 State: PUBLISHED Published: 2021-05-05T22:03:25 Last Updated: 2024-08-03T18:37:18.409Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/298847 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22211.json
CVE ID: CVE-2021-22212 State: PUBLISHED Published: 2021-06-08T12:07:02 Last Updated: 2024-08-03T18:37:18.446Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: NTPsec Products: ntpsec Problem Types: Improper filtering of special elements in ntpsec Description: ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly r
r not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/NTPsec/ntpsec/-/issues/699 - https://bugzilla.redhat.com/show_bug.cgi?id=1955859 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22212.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GIT2HYL5BQXPGKI6ZDNG473IEQ5WQF2/
CVE ID: CVE-2021-22213 State: PUBLISHED Published: 2021-06-08T18:03:58 Last Updated: 2024-08-03T18:37:18.348Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Insufficiently protected credentials in GitLab Description: A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/300308 - https://hackerone.com/reports/1089277 - https://gitlab.com/gitlab-org/cves/-/blob/master
ab-org/gitlab/-/issues/300308 - https://hackerone.com/reports/1089277 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22213.json
CVE ID: CVE-2021-22214 State: PUBLISHED Published: 2021-06-08T14:59:37 Last Updated: 2024-08-03T18:37:18.229Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/322926 - https://hacke
alyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/322926 - https://hackerone.com/reports/1110131 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22214.json
CVE ID: CVE-2021-22215 State: PUBLISHED Published: 2021-06-08T15:13:29 Last Updated: 2024-08-03T18:37:18.303Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/328668 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22215.json
CVE ID: CVE-2021-22216 State: PUBLISHED Published: 2021-06-08T19:19:25 Last Updated: 2024-08-03T18:37:18.260Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/329890 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22216.json
CVE ID: CVE-2021-22217 State: PUBLISHED Published: 2021-06-08T18:25:29 Last Updated: 2024-08-03T18:37:17.638Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/300709 - https://hackerone.com/reports/1090049 - https://gitlab.com/gitlab-org/cves/-/blob