deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29122
Published: 2022-05-10
Description: Windows Clustered Shared Volume Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29122; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29122
CVE: CVE-2022-29123
Published: 2022-05-10
Description: Windows Clustered Shared Volume Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29123; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29123
CVE: CVE-2022-29125
Published: 2022-05-10
Description: Windows Push Notifications Apps Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29125; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29125
CVE: CVE-2022-29126
Published: 2022-05-10
Description: Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29126; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29126
CVE: CVE-2022-29127
Published: 2022-05-10
Description: BitLocker Security Feature Bypass Vulnerability
CVSS Score: 4.2 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29127; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29127
CVE: CVE-2022-29128
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29128; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29128
CVE: CVE-2022-29129
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29129; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29129
CVE: CVE-2022-29130
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29130; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29130
CVE: CVE-2022-29131
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29131; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29131
CVE: CVE-2022-29132
Published: 2022-05-10
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29132; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29132
CVE: CVE-2022-29133
Published: 2022-05-10
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29133; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29133
CVE: CVE-2022-29134
Published: 2022-05-10
Description: Windows Clustered Shared Volume Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29134; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29134
CVE: CVE-2022-29135
Published: 2022-05-10
Description: Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29135; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29135
CVE: CVE-2022-29137
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29137; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29137
CVE: CVE-2022-29138
Published: 2022-05-10
Description: Windows Clustered Shared Volume Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29138; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29138
CVE: CVE-2022-29139
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29139; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29139
CVE: CVE-2022-29140
Published: 2022-05-10
Description: Windows Print Spooler Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29140; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29140
CVE: CVE-2022-29141
Published: 2022-05-10
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29141; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29141
CVE: CVE-2022-29142
Published: 2022-05-10
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29142; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29142
CVE: CVE-2022-29145
Published: 2022-05-10
Description: .NET and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29145; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNXQL7EZORGU4PZCPJ5EPQ4P7IEY3ZZO/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBYSBUDJYQ76HK4TULXVIIPCKK2U6WDB/
CVE: CVE-2022-29148
Published: 2022-05-10
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29148; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29148
CVE: CVE-2022-29150
Published: 2022-05-10
Description: Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29150; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29150
CVE: CVE-2022-29151
Published: 2022-05-10
Description: Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29151; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29151
CVE: CVE-2022-30129
Published: 2022-05-10
Description: Visual Studio Code Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30129; https://blog.sonarsource.com/securing-developer-tools-argument-injection-in-vscode/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30129
CVE: CVE-2022-30130
Published: 2022-05-10
Description: .NET Framework Denial of Service Vulnerability
CVSS Score: 3.3 (LOW)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30130; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30130
CVE: CVE-2022-26116
Published: 2022-05-11
Description: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://fortiguard.com/psirt/FG-IR-22-062; https://fortiguard.com/psirt/FG-IR-22-062
CVE: CVE-2020-19228
Published: 2022-05-11
Description: An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://bludit.com; https://github.com/bludit/bludit/issues/1242; http://bludit.com
CVE: CVE-2021-3254
Published: 2022-05-11
Description: Asus DSL-N14U-B1 1.1.2.3_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap.
CVSS Score: 7.5 (HIGH)
References: https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/2021-01-22-dsl-n14u.md; https://kaisersource.github.io/dsl-n14u-syn; https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/2021-01-22-dsl-n14u.md
CVE: CVE-2022-29316
Published: 2022-05-11
Description: Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackmd.io/%40taidh/SyioJJGEq; https://hackmd.io/%40taidh/SyioJJGEq
CVE: CVE-2022-29317
Published: 2022-05-11
Description: Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password parameters at /assets/partials/_handleLogin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackmd.io/%40taidh/r1FCJ1ME5; https://hackmd.io/%40taidh/r1FCJ1ME5
CVE: CVE-2022-29318
Published: 2022-05-11
Description: An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://hackmd.io/ITi4yd2-RgmDZh8FW-KTlA; https://hackmd.io/ITi4yd2-RgmDZh8FW-KTlA
CVE: CVE-2022-29655
Published: 2022-05-11
Description: An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://hackmd.io/HcH7QdEdRu67yfTJsKKFKA; https://hackmd.io/HcH7QdEdRu67yfTJsKKFKA
CVE: CVE-2022-29656
Published: 2022-05-11
Description: Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/package_detail.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackmd.io/g-3G1EGWTYa1hZZTEOh7Tw; https://hackmd.io/g-3G1EGWTYa1hZZTEOh7Tw
CVE: CVE-2022-29727
Published: 2022-05-11
Description: Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/167187/Survey-Sparrow-Enterprise-Survey-Software-2022-Cross-Site-Scripting.html; https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022; https://surveysparrow.com/
CVE: CVE-2022-29728
Published: 2022-05-11
Description: Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022; https://surveysparrow.com/; https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022
CVE: CVE-2022-29975
Published: 2022-05-11
Description: An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20CC%20endpoint; https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20CC%20endpoint
CVE: CVE-2022-29976
Published: 2022-05-11
Description: An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20BCC%20endpoint; https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20BCC%20endpoint
CVE: CVE-2022-28077
Published: 2022-05-11
Description: Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://home.com; https://github.com/bigzooooz/CVE-2022-28077; http://home.com
CVE: CVE-2022-28078
Published: 2022-05-11
Description: Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://home.com; https://github.com/bigzooooz/CVE-2022-28078; http://home.com
CVE: CVE-2022-29006
Published: 2022-05-11
Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sudoninja-noob/CVE-2022-29006/blob/main/CVE-2022-29006.txt; https://www.exploit-db.com/exploits/50370; https://github.com/sudoninja-noob/CVE-2022-29006/blob/main/CVE-2022-29006.txt
CVE: CVE-2022-29007
Published: 2022-05-11
Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sudoninja-noob/CVE-2022-29007/blob/main/CVE-2022-29007.txt; https://www.exploit-db.com/exploits/50365; https://github.com/sudoninja-noob/CVE-2022-29007/blob/main/CVE-2022-29007.txt
CVE: CVE-2022-29008
Published: 2022-05-11
Description: An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/sudoninja-noob/CVE-2022-29008/blob/main/CVE-2022-29008.txt; https://www.exploit-db.com/exploits/50263; https://github.com/sudoninja-noob/CVE-2022-29008/blob/main/CVE-2022-29008.txt
CVE: CVE-2022-29009
Published: 2022-05-11
Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sudoninja-noob/CVE-2022-29009/blob/main/CVE-2022-29009.txt; https://www.exploit-db.com/exploits/50355; https://github.com/sudoninja-noob/CVE-2022-29009/blob/main/CVE-2022-29009.txt
CVE: CVE-2022-29932
Published: 2022-05-11
Description: The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.md; https://www.primeur.com/managed-file-transfer; https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.md
CVE: CVE-2022-29977
Published: 2022-05-11
Description: There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/saitoha/libsixel/issues/165; https://github.com/saitoha/libsixel/issues/165
CVE: CVE-2022-29978
Published: 2022-05-11
Description: There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://github.com/saitoha/libsixel/issues/166; https://github.com/saitoha/libsixel/issues/166
CVE: CVE-2021-34605
Published: 2022-05-11
Description: A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.
CVSS Score: 7.3 (HIGH)
CWE: CWE-23
References: https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/; https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/
CVE: CVE-2021-34606
Published: 2022-05-11
Description: A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/; https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/
CVE: CVE-2021-37851
Published: 2022-05-11
Description: Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Internet Security 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Smart Security Premium 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Endpoint Antivirus 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Endpoint Security 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server 8.0 versions prior to 9.0.12012.0. ESET, spol. s r.o. ESET File Security for Microsoft Windows Server 8.0.12013.0. ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server 6.0 versions prior to 8.0.10020.0. ESET, spol. s r.o. ESET Mail Security for IBM Domino 6.0 versions prior to 8.0.14011.0. ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server 6.0 versions prior to 8.0.15009.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-280, CWE-755
References: https://support.eset.com/en/ca8268; https://support.eset.com/en/ca8268
CVE: CVE-2021-42651
Published: 2022-05-11
Description: A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1; https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1
CVE: CVE-2021-43081
Published: 2022-05-11
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-21-230; https://fortiguard.com/psirt/FG-IR-21-230
CVE: CVE-2021-44167
Published: 2022-05-11
Description: An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://fortiguard.com/psirt/FG-IR-21-232; https://fortiguard.com/psirt/FG-IR-21-232
CVE: CVE-2022-1124
Published: 2022-05-11
Description: An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1124.json; https://gitlab.com/gitlab-org/gitlab/-/issues/323552; https://hackerone.com/reports/1113405
CVE: CVE-2022-1352
Published: 2022-05-11
Description: Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1352.json; https://gitlab.com/gitlab-org/gitlab/-/issues/350691; https://hackerone.com/reports/1450306
CVE: CVE-2022-1406
Published: 2022-05-11
Description: Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353958; https://hackerone.com/reports/1485381
CVE: CVE-2022-1426
Published: 2022-05-11
Description: An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.
CVSS Score: 2.0 (LOW)
CWE: CWE-287
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.json; https://gitlab.com/gitlab-org/gitlab/-/issues/296866; https://hackerone.com/reports/1070097
CVE: CVE-2022-1428
Published: 2022-05-11
Description: An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json; https://gitlab.com/gitlab-org/gitlab/-/issues/342481; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json