Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22155 State: PUBLISHED Published: 2021-05-12T23:01:37 Last Updated: 2024-08-03T18:37:16.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s account. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000078926
CVE ID: CVE-2021-22156 State: PUBLISHED Published: 2021-08-17T18:35:38 Last Updated: 2025-08-22T15:20:31.911Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety Problem Types: Denial of service or arbitrary code execution, CWE-190 Description: An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a
r Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.blackberry.com/kb/articleDetail?articleNumber=000082334 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL
CVE ID: CVE-2021-22157 State: PUBLISHED Published: 2021-04-06T20:38:36 Last Updated: 2024-08-03T18:37:18.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0002
CVE ID: CVE-2021-22158 State: PUBLISHED Published: 2021-04-06T20:52:10 Last Updated: 2024-08-03T18:37:17.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0003
CVE ID: CVE-2021-22159 State: PUBLISHED Published: 2021-01-26T19:44:39 Last Updated: 2024-08-03T18:37:18.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier is missing authentication for a critical function, which allows a local authenticated Windows user to run arbitrary commands with the privileges of the Windows SYSTEM user. Agents for MacOS, Linux, and ITM Cloud are not affected. Additional Analyst Notes: - CVE P
s of the Windows SYSTEM user. Agents for MacOS, Linux, and ITM Cloud are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0001
CVE ID: CVE-2021-22160 State: PUBLISHED Published: 2021-05-26T12:22:31 Last Updated: 2024-08-03T18:37:18.090Z Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: token not validated Description: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E - htt
s.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rf2e90942996dceebac8296abf39257cfeb5ae918f82f7af3d37a48c5%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cusers.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973
86bbfcd42590da%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rbe845aa1573a61769b9c5916c62971f4b10de87c2ea5f38a97f0cf84%40%3Cdev.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df%40%3Cdev.pulsar.apache.org%3E
CVE ID: CVE-2021-22161 State: PUBLISHED Published: 2021-02-07T22:56:39 Last Updated: 2024-08-03T18:37:17.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenWrt 19.07.x before 19.07.7, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set. This affects the netifd and odhcp6c packages. Additional Analyst Notes: - CVE Progr
x for which the on-link flag is set. This affects the netifd and odhcp6c packages. Additional Analyst Notes: - CVE Program Container: References: - https://openwrt.org/advisory/2021-02-02-1
CVE ID: CVE-2021-22166 State: PUBLISHED Published: 2021-01-15T15:13:51 Last Updated: 2024-08-03T18:37:17.189Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/labkit/-/issues/29 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22166.json
CVE ID: CVE-2021-22167 State: PUBLISHED Published: 2021-01-15T15:12:17 Last Updated: 2024-08-03T18:37:18.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/289944 - https://hackerone.com/reports/1043480 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-221
sues/289944 - https://hackerone.com/reports/1043480 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22167.json
CVE ID: CVE-2021-22168 State: PUBLISHED Published: 2021-01-15T15:05:18 Last Updated: 2024-08-03T18:37:17.218Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/289950 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22168.json
CVE ID: CVE-2021-22169 State: PUBLISHED Published: 2021-03-24T17:03:04 Last Updated: 2024-08-03T18:37:18.113Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/289930 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22169.json
CVE ID: CVE-2021-22170 State: PUBLISHED Published: 2021-12-06T17:35:58 Last Updated: 2024-08-03T18:37:18.131Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Reusing a nonce, key pair in encryption in GitLab Description: Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/36855 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22170.json
CVE ID: CVE-2021-22171 State: PUBLISHED Published: 2021-01-15T15:10:39 Last Updated: 2024-08-03T18:37:18.342Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-pages/-/issues/262 - https://hackerone.com/reports/718460 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22171.json
CVE ID: CVE-2021-22172 State: PUBLISHED Published: 2021-03-26T19:06:48 Last Updated: 2024-08-03T18:37:17.263Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212911 - https://hackerone.com/reports/833334 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22172.json
CVE ID: CVE-2021-22173 State: PUBLISHED Published: 2021-02-17T14:26:20 Last Updated: 2024-08-03T18:37:17.473Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Missing release of memory after effective lifetime in Wireshark Description: Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-01.html - https://gitlab.com/wireshark/wireshark/-/issues/17124 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-
https://gitlab.com/wireshark/wireshark/-/issues/17124 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22173.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GND3PIQC3KZALR227V4YUMPKJBA5BZG4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYXLKQJ3D632XSG6VO7M4YFDAG6GRCLY/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.gentoo.org/glsa/202107-21
CVE ID: CVE-2021-22174 State: PUBLISHED Published: 2021-02-17T14:24:34 Last Updated: 2024-08-03T18:37:17.907Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Uncontrolled memory allocation in Wireshark Description: Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-02.html - https://gitlab.com/wireshark/wireshark/-/issues/17165 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22174.json - https://lists
ark/wireshark/-/issues/17165 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22174.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GND3PIQC3KZALR227V4YUMPKJBA5BZG4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYXLKQJ3D632XSG6VO7M4YFDAG6GRCLY/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.gentoo.org/glsa/202107-21
CVE ID: CVE-2021-22175 State: PUBLISHED Published: 2021-06-11T15:30:12 Last Updated: 2024-08-03T18:37:18.364Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/294178 - https://hackerone.
Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/294178 - https://hackerone.com/reports/1059596 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json
CVE ID: CVE-2021-22176 State: PUBLISHED Published: 2021-03-24T16:46:05 Last Updated: 2024-08-03T18:37:17.155Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/243491 - https://hackerone.com/reports/962604 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.json
CVE ID: CVE-2021-22177 State: PUBLISHED Published: 2021-04-01T14:19:07 Last Updated: 2024-08-03T18:37:17.998Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/238988 - https://hackerone.com/reports/953444 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22177.json
CVE ID: CVE-2021-22178 State: PUBLISHED Published: 2021-03-24T16:59:51 Last Updated: 2024-08-03T18:37:17.932Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/284819 - https://hackerone.com/reports/1037411 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22178.json
CVE ID: CVE-2021-22179 State: PUBLISHED Published: 2021-03-24T16:48:30 Last Updated: 2024-08-03T18:37:17.689Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/293733 - https://hackerone.com/reports/1055816 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22179.json
CVE ID: CVE-2021-22180 State: PUBLISHED Published: 2021-03-26T19:09:59 Last Updated: 2024-08-03T18:37:17.452Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/295662 - https://hackerone.com/reports/1064645 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22180.json
CVE ID: CVE-2021-22181 State: PUBLISHED Published: 2021-06-11T15:43:20 Last Updated: 2024-08-03T18:37:17.999Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/249100 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22181.json
CVE ID: CVE-2021-22182 State: PUBLISHED Published: 2021-03-03T17:57:50 Last Updated: 2024-08-03T18:37:17.169Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/280779 - https://hackerone.com/reports/1030189 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-221
sues/280779 - https://hackerone.com/reports/1030189 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22182.json
CVE ID: CVE-2021-22183 State: PUBLISHED Published: 2021-03-04T14:56:28 Last Updated: 2024-08-03T18:37:18.244Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/294176 - https://hackerone.com/reports/1055814 - https://gitla
ferences: - https://gitlab.com/gitlab-org/gitlab/-/issues/294176 - https://hackerone.com/reports/1055814 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22183.json
CVE ID: CVE-2021-22184 State: PUBLISHED Published: 2021-03-26T19:11:39 Last Updated: 2024-08-03T18:37:18.076Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Inclusion of sensitive information in log files in GitLab Description: An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/281676 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22184.json
CVE ID: CVE-2021-22185 State: PUBLISHED Published: 2021-03-24T16:39:21 Last Updated: 2024-08-03T18:37:18.297Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/299143 - https://hackerone.com/reports/1087061 - https://gitlab.
rences: - https://gitlab.com/gitlab-org/gitlab/-/issues/299143 - https://hackerone.com/reports/1087061 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22185.json
CVE ID: CVE-2021-22186 State: PUBLISHED Published: 2021-03-24T16:42:06 Last Updated: 2024-08-03T18:37:17.915Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/321653 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22186.json
CVE ID: CVE-2021-22187 State: PUBLISHED Published: 2021-03-02T18:15:16 Last Updated: 2024-08-03T18:37:18.277Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/300452 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22187.json
CVE ID: CVE-2021-22188 State: PUBLISHED Published: 2021-03-03T17:56:21 Last Updated: 2024-08-03T18:37:18.206Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/227040 - https://hackerone.com/reports/916340 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22188.json
CVE ID: CVE-2021-22189 State: PUBLISHED Published: 2021-03-04T14:54:34 Last Updated: 2024-08-03T18:37:18.364Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper certificate validation in GitLab Description: Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/296557 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22189.json