mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
dfb3188fd3
commit
84ee2fc527
@ -1,17 +1,61 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2021-42651",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2021-42651",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -71,7 +71,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories\u00a0via symbolic links."
|
||||
"value": "An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1352",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=11.0, <14.8.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.10, <14.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Authorization bypass through user-controlled key in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/350691",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/350691",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1450306",
|
||||
"url": "https://hackerone.com/reports/1450306",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1352.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1352.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [shells3c](https://hackerone.com/shells3c) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1406",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=14.10.0, <14.10.1"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9.0, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=8.12.0, <14.8.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper input validation in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/353958",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/353958",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1485381",
|
||||
"url": "https://hackerone.com/reports/1485381",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 6.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [@justas_b](https://hackerone.com/justas_b) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1426",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=12.6, <14.8.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.10, <14.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper authentication in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/296866",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/296866",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1070097",
|
||||
"url": "https://hackerone.com/reports/1070097",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 1.9,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [firelizzard](https://hackerone.com/firelizzard) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,92 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1428",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "<14.8.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.10, <14.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Allocation of resources without limits or throttling in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/342481",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/342481",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 4.2,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This vulnerability has been discovered internally by the GitLab team"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,97 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1433",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=14.4, <14.8.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.10, <14.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper neutralization of input during web page generation ('cross-site scripting') in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/357930",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/357930",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://hackerone.com/reports/1528829",
|
||||
"url": "https://hackerone.com/reports/1528829",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1433.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1433.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 2.6,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Thanks [stacksmashing](https://hackerone.com/stacksmashing) for reporting this vulnerability through our HackerOne bug bounty program"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,92 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1545",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "GitLab",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "GitLab",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": ">=13.2, <14.8.6"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.9, <14.9.4"
|
||||
},
|
||||
{
|
||||
"version_value": ">=14.10, <14.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper authorization in GitLab"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/351030",
|
||||
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/351030",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"version": "3.1",
|
||||
"baseScore": 4.2,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This vulnerability has been discovered internally by the GitLab team"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,91 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1622",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "libtiff",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "libtiff",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3079627ea0dee150e6a208cec8381de611bb842b"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Out-of-bounds read in libtiff"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/libtiff/libtiff/-/issues/410",
|
||||
"url": "https://gitlab.com/libtiff/libtiff/-/issues/410",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
|
||||
"url": "https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "wangdw.augustus@gmail.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -4,15 +4,91 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-1623",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@gitlab.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "libtiff",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "libtiff",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3079627ea0dee150e6a208cec8381de611bb842b"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Out-of-bounds read in libtiff"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gitlab.com/libtiff/libtiff/-/issues/410",
|
||||
"url": "https://gitlab.com/libtiff/libtiff/-/issues/410",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
|
||||
"url": "https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a",
|
||||
"refsource": "MISC"
|
||||
},
|
||||
{
|
||||
"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1623.json",
|
||||
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1623.json",
|
||||
"refsource": "CONFIRM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"version": "3.1",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "wangdw.augustus@gmail.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -52,11 +52,6 @@
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://kyocera.com",
|
||||
"refsource": "MISC",
|
||||
"name": "https://kyocera.com"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.gruppotim.it/it/footer/red-team.html",
|
||||
|
||||
@ -52,11 +52,6 @@
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://kyocera.com",
|
||||
"refsource": "MISC",
|
||||
"name": "https://kyocera.com"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.gruppotim.it/it/footer/red-team.html",
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -61,6 +61,11 @@
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/",
|
||||
"url": "https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user