Update now! GitLab issues critical security release for RCE vulnerability

GitLab has released versions 15.3.1, 15.2.3, 15.1.5 for GitLab Community Edition CE and Enterprise Edition EE. These versions contain important security fixes, and its recommended that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the...

Input validation flaw in GitLab’s Community and Enterprise Software

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary A remote code execution vulnerability that affects GitLab Community Edition CE and Enterprise Edition EE has been identified as CVE-2022-2884. It can be exploited using the GitHub import API, However it...

GitLab: Remote Command Execution via Github import

Summary This is very similar to https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/Remote%20Command%20Execution%20via%20Github%20import and allows arbitrary redis commands to be injected when imported a GitHub repository. When importing a GitHub repo the...

GitLab Issues Patch for Critical Flaw in its Community and Enterprise Software

DevOps platform GitLab this week issued patches to address a critical security flaw in its software that could lead to arbitrary code execution on affected systems. Tracked as CVE-2022-2884, the issue is rated 9.9 on the CVSS vulnerability scoring system and impacts all versions of GitLab Communi...

CVE-2022-2884

creationtimestamp| type| source ---|---|--- 2022-08-23 21:14:03+00:00| seen| https://t.me/informationsecuritychannel/48290 2022-08-24 08:56:15+00:00| seen| https://t.me/habrcomnews/9214 2022-08-24 11:17:10+00:00| seen| https://t.me/codebysec/6456 2022-08-24 12:56:29+00:00| seen|...

FreeBSD : Gitlab -- Remote Code Execution (8a0cd618-22a0-11ed-b1e7-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8a0cd618-22a0-11ed-b1e7-001b217b3468 advisory. - Gitlab reports: Remote Command Execution via Github import CVE-2022-2884 Note that Nessus has not...

Mageia: Security Advisory (MGASA-2013-0249)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2884

creationtimestamp| type| source ---|---|--- 2020-10-09 14:41:34+00:00| seen| MISP/493d0223-34b0-4116-a4f4-8b48f15ed060 2025-08-31 03:01:06+00:00| seen| MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d 2025-08-31 03:12:47+00:00| seen| MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57 2026-06-19 16:45:39+00:00|...

CVE-2020-2884

CVE-2020-2884 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware. Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. The vulnerability enables unauthenticated remote compromise over IIOP/T3, with the potential takeover of WebLogic Server (high/critical impact ...

CVE-2019-2884

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Segment. The supported version that is affected is 17.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2019-2884

CVE-2019-2884 affects Oracle Retail Applications’ Retail Customer Management and Segmentation Foundation, specifically the Segment component, with the affected version being 17.0. The Red Hat and NVD records describe an unauthenticated, network-access vulnerability over HTTP that can lead to unau...

CentOS 7 : firefox (CESA-2018:2884)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Security Bulletin: IBM Forms Experience Builder vulnerable to CSRF when configured with non default settings (CVE-2016-2884)

Summary A cross-site request forgery attack is possible when configured with non default settings, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-2884 DESCRIPTION: IBM Forms Experience Builder is vulnerable to cross-site request forgery, when configure...

CVE-2015-2884

CVE-2015-2884 affects Philips In.Sight B120/37, a video monitoring device. The connected sources confirm an information-disclosure vulnerability that allows remote attackers to obtain sensitive data via a direct request, referencing yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi. Th...

CVE-2016-2884

IBM Forms Experience Builder is vulnerable to cross-site request forgery when configured with non-default settings. The issue arises from improper validation of user-supplied input, enabling a remote attacker to craft requests authenticated as the user and potentially insert XSS sequences. Affect...

CVE-2016-2884

Cross-site request forgery CSRF vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Google Chrome Security Updates (stable-channel-update_30-2013-07) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2884-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2884-1 advisory. Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploi...

CVE-2015-5423

Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2884...

Code injection

Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2884...