CVSS: 9.6EPSS: 0%CPEs: 6EXPL: 1CVE-2021-22234
https://notcve.org/view.php?id=CVE-2021-22234
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 13.11 antes de la 13.11.7, a todas las versiones a partir de la 13.12 antes de la 13.12.8 y a todas las versiones a partir de la 14.0 antes de la 14.0.4. Una imagen de diseño especialmente diseñada permitía a los atacantes leer archivos arbitrarios en el servidor • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22234.json https://gitlab.com/gitlab-org/gitlab/-/issues/335205 https://hackerone.com/reports/1212067 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22241
https://notcve.org/view.php?id=CVE-2021-22241
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 14.0. Era posible explotar una vulnerabilidad de tipo cross-site-scripting almacenado por medio de un nombre de rama predeterminado específicamente diseñado • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22241.json https://gitlab.com/gitlab-org/gitlab/-/issues/336460 https://hackerone.com/reports/1256777 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-22240
https://notcve.org/view.php?id=CVE-2021-22240
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled Un control de acceso inapropiado en GitLab EE versiones 13.11.6, 13.12.6 y 14.0.2, permite la creación de usuarios por medio de single sign on a pesar de estar habilitado el user cap • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22240.json https://gitlab.com/gitlab-org/gitlab/-/issues/327641 https://hackerone.com/reports/1166566 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2021-22233
https://notcve.org/view.php?id=CVE-2021-22233
An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details Una vulnerabilidad de divulgación de información en GitLab EE versiones 13.10 y posteriores, permitía a un usuario leer detalles del proyecto • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22233.json https://gitlab.com/gitlab-org/gitlab/-/issues/329446 • CWE-862: Missing Authorization •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22224
https://notcve.org/view.php?id=CVE-2021-22224
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim Una vulnerabilidad de tipo cross-site request forgery en la API GraphQL en GitLab desde la versión 13.12 y versiones anteriores a 13.12.6 y 14.0.2, permitía a un atacante llamar a mutaciones como la víctima • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json https://gitlab.com/gitlab-org/gitlab/-/issues/324397 https://hackerone.com/reports/1122408 • CWE-352: Cross-Site Request Forgery (CSRF) •