Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
om/gitlab-org/gitlab/-/issues/300709 - https://hackerone.com/reports/1090049 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22217.json
CVE ID: CVE-2021-22218 State: PUBLISHED Published: 2021-06-08T15:04:57 Last Updated: 2024-08-03T18:37:17.682Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Authentication bypass by spoofing in GitLab Description: All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/297665 - https://hacke
alyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/297665 - https://hackerone.com/reports/1077019 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22218.json
CVE ID: CVE-2021-22219 State: PUBLISHED Published: 2021-06-08T18:38:17 Last Updated: 2024-08-03T18:37:17.702Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Inclusion of sensitive information in log files in GitLab Description: All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab
ot correctly registered for log masking. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/296995 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22219.json
CVE ID: CVE-2021-22220 State: PUBLISHED Published: 2021-06-08T19:05:00 Last Updated: 2024-08-03T18:37:18.105Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/294128 - https://hackerone.com/reports/1060114 - https://gitlab.com/gitlab-org/cves/-/blob/master/20
org/gitlab/-/issues/294128 - https://hackerone.com/reports/1060114 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22220.json
CVE ID: CVE-2021-22221 State: PUBLISHED Published: 2021-06-08T18:52:20 Last Updated: 2024-08-03T18:37:18.251Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Weak password requirements in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitl
ss after their password expired Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/292006 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22221.json
CVE ID: CVE-2021-22222 State: PUBLISHED Published: 2021-06-07T12:01:14 Last Updated: 2024-08-03T18:37:18.527Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Loop with unreachable exit condition ('infinite loop') in Wireshark Description: Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-05.html - https://gitlab.com/wireshark/wireshark/-/merge_requests/3130 - https://gitlab.com/gitlab-org/cves/-/blob/maste
05.html - https://gitlab.com/wireshark/wireshark/-/merge_requests/3130 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22222.json - https://security.gentoo.org/glsa/202107-21 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.debian.org/security/2021/dsa-5019
CVE ID: CVE-2021-22223 State: PUBLISHED Published: 2021-07-06T21:50:25 Last Updated: 2024-08-03T18:37:18.268Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/293946 - https://hackerone.com/reports/1059557 - http
ainer: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/293946 - https://hackerone.com/reports/1059557 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22223.json
CVE ID: CVE-2021-22224 State: PUBLISHED Published: 2021-07-07T11:26:37 Last Updated: 2024-08-03T18:37:18.269Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Cross-site request forgery (csrf) in GitLab Description: A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/324397 - https://hackerone.com/reports/1122408 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.js
324397 - https://hackerone.com/reports/1122408 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json
CVE ID: CVE-2021-22225 State: PUBLISHED Published: 2021-07-07T11:19:53 Last Updated: 2024-08-03T18:37:17.432Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/331051 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2
es: - https://gitlab.com/gitlab-org/gitlab/-/issues/331051 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22225.json
CVE ID: CVE-2021-22226 State: PUBLISHED Published: 2021-07-06T20:56:53 Last Updated: 2024-08-03T18:37:17.937Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/326684 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22226.json
CVE ID: CVE-2021-22227 State: PUBLISHED Published: 2021-07-07T10:40:54 Last Updated: 2024-08-03T18:37:18.316Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212887 - https://hackerone.com/reports/8
Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212887 - https://hackerone.com/reports/834555 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22227.json
CVE ID: CVE-2021-22228 State: PUBLISHED Published: 2021-07-06T21:34:10 Last Updated: 2024-08-03T18:37:18.219Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/332605 - https://hackerone.com/reports/119
rogram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/332605 - https://hackerone.com/reports/1192460 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22228.json
CVE ID: CVE-2021-22229 State: PUBLISHED Published: 2021-07-06T20:30:47 Last Updated: 2024-08-03T18:37:17.875Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/332609 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22229.json
CVE ID: CVE-2021-22230 State: PUBLISHED Published: 2021-07-07T10:47:31 Last Updated: 2024-08-03T18:37:18.220Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper encoding or escaping of output in GitLab Description: Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/211976 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22230.json
CVE ID: CVE-2021-22231 State: PUBLISHED Published: 2021-07-07T10:28:23 Last Updated: 2024-08-03T18:37:18.497Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/26295 - https://hackerone.com/reports/475098 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22231.json
CVE ID: CVE-2021-22232 State: PUBLISHED Published: 2021-07-06T20:43:43 Last Updated: 2024-08-03T18:37:18.237Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper limitation of a pathname to a restricted directory ('path traversal') in GitLab Description: HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/300713 - https://hackerone.com/reports/1090634 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22232.json
CVE ID: CVE-2021-22233 State: PUBLISHED Published: 2021-07-07T13:22:15 Last Updated: 2024-08-03T18:37:18.418Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/329446 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22233.json
CVE ID: CVE-2021-22234 State: PUBLISHED Published: 2021-08-05T20:30:25 Last Updated: 2024-08-03T18:37:18.427Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/335205 - https://h
l Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/335205 - https://hackerone.com/reports/1212067 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.json
CVE ID: CVE-2021-22235 State: PUBLISHED Published: 2021-07-20T00:00:00 Last Updated: 2024-08-03T18:37:18.219Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Wireshark Foundation Products: Wireshark Problem Types: Mismatched memory management routines in Wireshark Description: Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2021-05.html - https://gitlab.com/wireshark/wireshark/-/issues/17462 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22
ttps://gitlab.com/wireshark/wireshark/-/issues/17462 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22235.json - https://www.debian.org/security/2021/dsa-5019 - https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html - https://security.gentoo.org/glsa/202210-04
CVE ID: CVE-2021-22236 State: PUBLISHED Published: 2021-08-25T18:39:18 Last Updated: 2024-08-03T18:37:18.092Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/334925 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22236.json
CVE ID: CVE-2021-22237 State: PUBLISHED Published: 2021-08-25T18:37:19 Last Updated: 2024-08-03T18:37:18.434Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper privilege management in GitLab Description: Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/297516 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22237.j
://gitlab.com/gitlab-org/gitlab/-/issues/297516 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22237.json
CVE ID: CVE-2021-22238 State: PUBLISHED Published: 2021-08-20T17:39:54 Last Updated: 2024-08-03T18:37:18.293Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1212067 - https://gitlab.com/gitlab-org/gitlab/-/issues/332420 - https://gitlab.com/gitlab-org/cves/-/blob/
.com/reports/1212067 - https://gitlab.com/gitlab-org/gitlab/-/issues/332420 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22238.json
CVE ID: CVE-2021-22239 State: PUBLISHED Published: 2021-09-09T14:41:34 Last Updated: 2024-08-03T18:37:18.281Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/336301 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22239.json
CVE ID: CVE-2021-22240 State: PUBLISHED Published: 2021-08-05T19:25:09 Last Updated: 2024-08-03T18:37:18.341Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab EE Problem Types: Improper access control in GitLab EE Description: Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/327641 - https://hackerone.com/reports/1166566 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22240.json
CVE ID: CVE-2021-22241 State: PUBLISHED Published: 2021-08-05T19:28:23 Last Updated: 2024-08-03T18:37:18.367Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/336460 - https://hackerone.com/reports/1256777 - https://gi
References: - https://gitlab.com/gitlab-org/gitlab/-/issues/336460 - https://hackerone.com/reports/1256777 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22241.json
CVE ID: CVE-2021-22242 State: PUBLISHED Published: 2021-08-25T18:38:24 Last Updated: 2024-08-03T18:37:18.232Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/332528 - https://hackerone.com/reports/1212822 - https://
r: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/332528 - https://hackerone.com/reports/1212822 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22242.json
CVE ID: CVE-2021-22243 State: PUBLISHED Published: 2021-08-25T18:36:06 Last Updated: 2024-08-03T18:37:18.309Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: GitLab Products: GitLab Problem Types: Missing authorization in GitLab Description: Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/325934 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22243.json
CVE ID: CVE-2021-22244 State: PUBLISHED Published: 2021-08-25T18:34:06 Last Updated: 2024-08-03T18:37:18.393Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/299039 - https://hackerone.com/reports/1047140 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22244.json
CVE ID: CVE-2021-22245 State: PUBLISHED Published: 2021-08-25T18:31:57 Last Updated: 2024-08-03T18:37:18.243Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper input validation in GitLab Description: Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/255612 - https://hackerone.com/reports/987689 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22245.json
CVE ID: CVE-2021-22246 State: PUBLISHED Published: 2021-08-20T17:38:43 Last Updated: 2024-08-03T18:37:18.252Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Allocation of resources without limits or throttling in GitLab Description: A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/280633 - https://hackerone.com/reports/1029269 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22246.json
CVE ID: CVE-2021-22247 State: PUBLISHED Published: 2021-08-25T18:32:59 Last Updated: 2024-08-03T18:37:18.175Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/299333 - https://hackerone.com/reports/1074326 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22247.json
CVE ID: CVE-2021-22248 State: PUBLISHED Published: 2021-08-23T19:42:07 Last Updated: 2024-08-03T18:37:18.266Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/336074 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22248.