deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41092
Published: 2021-10-04
Description: Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf; https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b; https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
CVE: CVE-2020-21431
Published: 2021-10-04
Description: HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/Neeke/HongCMS/issues/14; https://github.com/Neeke/HongCMS/issues/14
CVE: CVE-2020-21434
Published: 2021-10-04
Description: Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Ksharp12138/maccms_userinfo_xss/blob/master/maccms_xss.md; https://github.com/Ksharp12138/maccms_userinfo_xss/blob/master/maccms_xss.md
CVE: CVE-2020-21493
Published: 2021-10-04
Description: An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.
CVSS Score: 5.3 (MEDIUM)
References: https://gitee.com/xiuno/xiunobbs/issues/I1690W; https://github.com/wanghaiwei/xiuno-docker/issues/3; https://gitee.com/xiuno/xiunobbs/issues/I1690W
CVE: CVE-2020-21494
Published: 2021-10-04
Description: A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via changing the doctype value to 0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/xiuno/xiunobbs/issues/I16BHH; https://github.com/wanghaiwei/xiuno-docker/issues/4; https://gitee.com/xiuno/xiunobbs/issues/I16BHH
CVE: CVE-2020-21495
Published: 2021-10-04
Description: A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitename parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/xiuno/xiunobbs/issues/I16BI3; https://github.com/wanghaiwei/xiuno-docker/issues/5; https://gitee.com/xiuno/xiunobbs/issues/I16BI3
CVE: CVE-2020-21496
Published: 2021-10-04
Description: A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML via the sitebrief parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/xiuno/xiunobbs/issues/I16BI3; https://github.com/wanghaiwei/xiuno-docker/issues/5; https://gitee.com/xiuno/xiunobbs/issues/I16BI3
CVE: CVE-2021-32765
Published: 2021-10-04
Description: Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-680, CWE-190
References: https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e; https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2; https://lists.debian.org/debian-lts-announce/2021/10/msg00007.html
CVE: CVE-2021-41089
Published: 2021-10-04
Description: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
CVSS Score: 2.8 (LOW)
CWE: CWE-281, CWE-281
References: https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf; https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a; https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
CVE: CVE-2021-41091
Published: 2021-10-04
Description: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-281, CWE-732
References: https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf; https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64; https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
CVE: CVE-2021-41123
Published: 2021-10-04
Description: Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9; https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3j; https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9
CVE: CVE-2021-42006
Published: 2021-10-04
Description: An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted GFF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/gpertea/gclib/issues/11; https://github.com/gpertea/gclib/issues/11
CVE: CVE-2021-42008
Published: 2021-10-05
Description: The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb[PII_REDACTED]793; https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
CVE: CVE-2021-41524
Published: 2021-10-05
Description: While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2021/10/05/1; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
CVE: CVE-2021-41773
Published: 2021-10-05
Description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html; http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html; http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html
CVE: CVE-2021-35503
Published: 2021-10-05
Description: Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.filerun.com; https://syntegris-sec.github.io/filerun-advisory; http://blog.filerun.com
CVE: CVE-2021-35504
Published: 2021-10-05
Description: Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: http://blog.filerun.com; https://syntegris-sec.github.io/filerun-advisory; http://blog.filerun.com
CVE: CVE-2021-35505
Published: 2021-10-05
Description: Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: http://blog.filerun.com; https://syntegris-sec.github.io/filerun-advisory; http://blog.filerun.com
CVE: CVE-2021-37223
Published: 2021-10-05
Description: Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://nagios.com; https://www.nagios.com/downloads/nagios-xi/change-log/; http://nagios.com
CVE: CVE-2021-39887
Published: 2021-10-05
Description: A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39887.json; https://gitlab.com/gitlab-org/gitlab/-/issues/332903; https://hackerone.com/reports/1218174
CVE: CVE-2021-35506
Published: 2021-10-05
Description: Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.filerun.com; https://syntegris-sec.github.io/filerun-advisory; http://blog.filerun.com
CVE: CVE-2021-39866
Published: 2021-10-05
Description: A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
CVSS Score: 5.4 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39866.json; https://gitlab.com/gitlab-org/gitlab/-/issues/333175; https://hackerone.com/reports/1199561
CVE: CVE-2021-39867
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39867.json; https://gitlab.com/gitlab-org/gitlab/-/issues/214401; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39867.json
CVE: CVE-2021-39869
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39869.json; https://gitlab.com/gitlab-org/gitlab/-/issues/27044; https://hackerone.com/reports/497144
CVE: CVE-2021-39872
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through git and API through access tokens acquired before password expiration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39872.json; https://gitlab.com/gitlab-org/gitlab/-/issues/337954; https://hackerone.com/reports/1285226
CVE: CVE-2021-39875
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visiting an API endpoint.
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39875.json; https://gitlab.com/gitlab-org/gitlab/-/issues/290985; https://hackerone.com/reports/1048259
CVE: CVE-2021-39878
Published: 2021-10-05
Description: A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javascript code.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39878.json; https://gitlab.com/gitlab-org/gitlab/-/issues/334043; https://hackerone.com/reports/1194254
CVE: CVE-2021-39882
Published: 2021-10-05
Description: In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39882.json; https://gitlab.com/gitlab-org/gitlab/-/issues/297473; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39882.json
CVE: CVE-2021-39884
Published: 2021-10-05
Description: In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39884.json; https://gitlab.com/gitlab-org/gitlab/-/issues/25414; https://hackerone.com/reports/447817
CVE: CVE-2021-39888
Published: 2021-10-05
Description: In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39888.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336446; https://hackerone.com/reports/1255128
CVE: CVE-2021-39893
Published: 2021-10-05
Description: A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39893.json; https://gitlab.com/gitlab-org/gitlab/-/issues/340076; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39893.json
CVE: CVE-2021-39894
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39894.json; https://gitlab.com/gitlab-org/gitlab/-/issues/214399; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39894.json
CVE: CVE-2021-22257
Published: 2021-10-05
Description: An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22257.json; https://gitlab.com/gitlab-org/gitlab/-/issues/23832; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22257.json
CVE: CVE-2021-22258
Published: 2021-10-05
Description: The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22258.json; https://gitlab.com/gitlab-org/gitlab/-/issues/24231; https://hackerone.com/reports/410436
CVE: CVE-2021-22261
Published: 2021-10-05
Description: A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responses
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22261.json; https://gitlab.com/gitlab-org/gitlab/-/issues/328389; https://hackerone.com/reports/1132083
CVE: CVE-2021-22262
Published: 2021-10-05
Description: Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22262.json; https://gitlab.com/gitlab-org/gitlab/-/issues/327062; https://hackerone.com/reports/1147812
CVE: CVE-2021-22264
Published: 2021-10-05
Description: An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted.
CVSS Score: 6.8 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22264.json; https://gitlab.com/gitlab-org/gitlab/-/issues/336073; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22264.json
CVE: CVE-2021-39870
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39870.json; https://gitlab.com/gitlab-org/gitlab/-/issues/29748; https://hackerone.com/reports/630263
CVE: CVE-2021-39881
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
CVSS Score: 3.5 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39881.json; https://gitlab.com/gitlab-org/gitlab/-/issues/26695; https://hackerone.com/reports/494530
CVE: CVE-2021-39886
Published: 2021-10-05
Description: Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
CVSS Score: 2.6 (LOW)
CWE: CWE-276
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.json; https://gitlab.com/gitlab-org/gitlab/-/issues/330520; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39886.json
CVE: CVE-2021-39889
Published: 2021-10-05
Description: In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39889.json; https://gitlab.com/gitlab-org/gitlab/-/issues/338062; https://hackerone.com/reports/1294017
CVE: CVE-2021-39891
Published: 2021-10-05
Description: In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-212
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json; https://gitlab.com/gitlab-org/gitlab/-/issues/335137; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39891.json
CVE: CVE-2021-39880
Published: 2021-10-05
Description: A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json; https://gitlab.com/gitlab-org/gitlab/-/issues/330561; https://hackerone.com/reports/1181284