deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0901
Published: 2022-04-04
Description: The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166626/WordPress-Ad-Inserter-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/85582b4f-a40a-4394-9834-0c88c5dc57ba; http://packetstormsecurity.com/files/166626/WordPress-Ad-Inserter-Cross-Site-Scripting.html
CVE: CVE-2022-0958
Published: 2022-04-04
Description: The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2679436; https://wpscan.com/vulnerability/05034521-6eb9-43b9-8f03-7e0de60e3022; https://plugins.trac.wordpress.org/changeset/2679436
CVE: CVE-2022-1164
Published: 2022-04-04
Description: The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/157a9a76-3e5f-4d27-aefc-cb9cb88b3286; https://wpscan.com/vulnerability/157a9a76-3e5f-4d27-aefc-cb9cb88b3286
CVE: CVE-2022-1165
Published: 2022-04-04
Description: The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset/2666486; https://wpscan.com/vulnerability/10d85913-ea8c-4c2e-a32e-fa61cf191710; https://plugins.trac.wordpress.org/changeset/2666486
CVE: CVE-2022-1166
Published: 2022-04-04
Description: The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446; https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189; https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
CVE: CVE-2022-1167
Published: 2022-04-04
Description: There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://m0ze.ru/vulnerability/%5B2020-06-17%5D-%5BWordPress%5D-%5BCWE-79%5D-CareerUp-WordPress-Theme-v2.3.0.txt; https://themeforest.net/item/careerup-job-board-wordpress-theme/24002090; https://wpscan.com/vulnerability/a30a1430-c474-4cd1-877c-35c4ab624170
CVE: CVE-2022-1168
Published: 2022-04-04
Description: There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856; https://wpscan.com/vulnerability/bcf38e87-011e-4540-8bfb-c93443a4a490; https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856
CVE: CVE-2022-1169
Published: 2022-04-04
Description: There is a XSS vulnerability in Careerfy.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/careerfy-job-board-wordpress-theme/21137053; https://wpscan.com/vulnerability/f3a1dcad-528a-4ecc-ac8e-728caa7c9878; https://themeforest.net/item/careerfy-job-board-wordpress-theme/21137053
CVE: CVE-2022-1170
Published: 2022-04-04
Description: In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446; https://wpscan.com/vulnerability/2ecb18e6-b575-4a20-bd31-94d24f1d1efc; https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
CVE: CVE-2020-28062
Published: 2022-04-04
Description: An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/ Upload/Plugins /, which could let a remote malicious user execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/hisiphp/hisiphp/issues/10; https://github.com/hisiphp/hisiphp/issues/10
CVE: CVE-2022-24785
Published: 2022-04-04
Description: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-27, CWE-22
References: https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5; https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4; https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
CVE: CVE-2021-43464
Published: 2022-04-04
Description: A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
CVSS Score: 8.8 (HIGH)
References: https://github.com/intelliants/subrion/issues/888; https://github.com/intelliants/subrion/issues/888
CVE: CVE-2022-0990
Published: 2022-04-04
Description: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367; https://huntr.dev/bounties/31649903-c19c-4dae-aee0-a04b095855c5; https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367
CVE: CVE-2022-24787
Published: 2022-04-04
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697, CWE-697
References: https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508; https://github.com/vyperlang/vyper/security/advisories/GHSA-7vrm-3jc8-5wwm; https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508
CVE: CVE-2022-24801
Published: 2022-04-04
Description: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.
CVSS Score: 8.1 (HIGH)
CWE: CWE-444, CWE-444
References: https://github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac; https://github.com/twisted/twisted/releases/tag/twisted-22.4.0rc1; https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq
CVE: CVE-2022-24813
Published: 2022-04-04
Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-288, CWE-287
References: https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9; https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg; https://phabricator.miraheze.org/T9018
CVE: CVE-2022-24814
Published: 2022-04-04
Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/directus/directus/pull/12020; https://github.com/directus/directus/releases/tag/v9.7.0; https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84
CVE: CVE-2022-25569
Published: 2022-04-04
Description: Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.andreabruschi.net/2022/02/17/bettini-s-r-l-sgsetup-hard-coded-ssh-private-key/; https://www.andreabruschi.net/2022/02/17/bettini-s-r-l-sgsetup-hard-coded-ssh-private-key/
CVE: CVE-2022-26572
Published: 2022-04-04
Description: Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://github.com/yj12341/ColorQube-8580-/blob/main/README.md; https://github.com/yj12341/ColorQube-8580-/blob/main/README.md
CVE: CVE-2021-32977
Published: 2022-04-04
Description: AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347, CWE-347
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE: CVE-2021-32978
Published: 2022-04-04
Description: The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-256, CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02
CVE: CVE-2021-32980
Published: 2022-04-04
Description: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02
CVE: CVE-2021-32981
Published: 2022-04-04
Description: AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE: CVE-2021-32982
Published: 2022-04-04
Description: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02
CVE: CVE-2021-32984
Published: 2022-04-04
Description: All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project without authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02
CVE: CVE-2021-32985
Published: 2022-04-04
Description: AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.
CVSS Score: 7.2 (HIGH)
CWE: CWE-346, CWE-346
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE: CVE-2021-32986
Published: 2022-04-04
Description: After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without authorization. The PLC is only relocked by a power cycle, or when the programming software disconnects correctly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-863
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02
CVE: CVE-2021-32994
Published: 2022-04-04
Description: Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-168-02
CVE: CVE-2021-33008
Published: 2022-04-04
Description: AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE: CVE-2021-33010
Published: 2022-04-04
Description: An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE: CVE-2021-36826
Published: 2022-04-04
Description: Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-4-13-stored-cross-site-scripting-xss-vulnerability-1?_s_id=cve; https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-4-13-stored-cross-site-scripting-xss-vulnerability-1?_s_id=cve
CVE: CVE-2021-36851
Published: 2022-04-04
Description: Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/testimonial-add/wordpress-testimonial-slider-plugin-3-5-8-3-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/testimonial-add/#developers; https://patchstack.com/database/vulnerability/testimonial-add/wordpress-testimonial-slider-plugin-3-5-8-3-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-0740
Published: 2022-04-04
Description: Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0740.json; https://gitlab.com/gitlab-org/gitlab/-/issues/349359; https://hackerone.com/reports/1411216
CVE: CVE-2022-1099
Published: 2022-04-04
Description: Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1099.json; https://gitlab.com/gitlab-org/gitlab/-/issues/328593; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1099.json
CVE: CVE-2022-1100
Published: 2022-04-04
Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-772
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1100.json; https://gitlab.com/gitlab-org/gitlab/-/issues/273771; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1100.json
CVE: CVE-2022-1105
Published: 2022-04-04
Description: An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json; https://gitlab.com/gitlab-org/gitlab/-/issues/335933; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json
CVE: CVE-2022-1111
Published: 2022-04-04
Description: A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages
CVSS Score: 2.4 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1111.json; https://gitlab.com/gitlab-org/gitlab/-/issues/345236; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1111.json
CVE: CVE-2022-1120
Published: 2022-04-04
Description: Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1120.json; https://gitlab.com/gitlab-org/gitlab/-/issues/343466; https://hackerone.com/reports/1408731
CVE: CVE-2022-1121
Published: 2022-04-04
Description: A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1121.json; https://gitlab.com/gitlab-org/gitlab-pages/-/issues/684; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1121.json
CVE: CVE-2022-1148
Published: 2022-04-04
Description: Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-565
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1148.json; https://gitlab.com/gitlab-org/gitlab/-/issues/350687; https://hackerone.com/reports/1439552
CVE: CVE-2022-1162
Published: 2022-04-04
Description: A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/166828/Gitlab-14.9-Authentication-Bypass.html; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1162.json; https://gitlab.com/gitlab-org/gitlab/-/issues/357210
CVE: CVE-2022-1174
Published: 2022-04-04
Description: A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1174.json; https://gitlab.com/gitlab-org/gitlab/-/issues/338721; https://hackerone.com/reports/1305431