CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

CVE-2021-22234

CVE-2021-22234 affects GitLab CE/EE: all versions from 13.11 up to but not including 13.11.7, all 13.12 series before 13.12.8, and all 14.0 series before 14.0.4. The issue involves a specially crafted design image that allows attackers to read arbitrary files on the server. Root cause and vulnera...

CVE-2021-22240

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...

CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

UBUNTU-CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22241

GitLab CE/EE versions starting from 14.0 are affected by CVE-2021-22241, which enables stored cross-site scripting via a crafted default branch name. The Arch Linux advisory confirms the issue is fixed upstream in GitLab 14.1.2 (issue resolved in 14.1.2-1); other sources list affected ranges as 1...

CVE-2021-22241: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22240: Incorrect Authorization

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...

CVE-2021-22234: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

IBM WebSphere Application Server Elevation of Privilege Vulnerability (CNVD-2021-71530)

IBM WebSphere Application Server WAS is an application server developed and distributed by IBM in compliance with open standards, such as Java EE, XML and Web Services. IBM WebSphere Application Server versions 7.0, 8.0, 8.5, 9.0 An elevation of privilege vulnerability exists. A remote attacker...

CVE-2021-2341

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...

CVE-2021-2341

CVE-2021-2341 affects Java SE and Oracle GraalVM Enterprise Edition (affected components: Networking, Library, Hotspot) with Java SE versions 7u301, 8u291, 11.0.11, 16.0.1 and GraalVM EE 20.3.2/21.1.0. The vulnerability can allow unauthorized read access via network access and requires human inte...

CVE-2021-2341

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...

Information disclosure

An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details...

CVE-2021-22230

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

CVE-2021-22231

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username...

Design/Logic Flaw

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2...

Denial of service

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username...

CVE-2021-22231

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username...