CVE-2021-22205

CVE-2021-22205 affects GitLab CE/EE from version 11.9 onward. The root cause is improper validation of image files handed to a file parser, which can lead to remote code execution on the affected GitLab server. Public advisories summarize that exploitation delivers remote code execution through c...

CVE-2021-22205

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Recent assessments: jbaines-r7 at November 01, 2021 2:33pm UTC reported:...

CVE-2021-0257

On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPCs Modular Port Concentrators where Integrated Routing and Bridging IRB interfaces are configured and mapped to a VPLS instance or a Bridge-Domain, certain Layer 2 network events at Customer Edge CE devices may cause memo...

CVE-2021-0257

CVE-2021-0257 affects Juniper Junos OS on MX Series and EX9200 Series with Trio-based MPCs where IRB interfaces are mapped to a VPLS or Bridge-Domain. The issue is a memory leak in the MPC that can lead to an out-of-memory condition and an MPC restart, causing temporary traffic interruptions. Aff...

Security Bulletin: IBM Cloud Automation Manager Content Runtime is affected by an issue with Docker before 19.03.15.

Summary IBM Cloud Automation Manager Content Runtime is affected by an issue with Docker before 19.03.15. as described in CVE-2021-21284 and CVE-2021-21285. If you have IBM Cloud Automation Manager Content Runtime with docker engine 19.03.14 or earlier installed, upgrade it to 19.03.15...

Security Bulletin: IBM Cloud Pak for Multicloud Management Managed Service Content Runtime is affected by an issue with Docker before 19.03.15.

Summary IBM Cloud Pak for Multicloud Management Managed Service Content Runtime is affected by an issue with Docker before 19.03.15. as described in CVE-2021-21284 and CVE-2021-21285. If you have IBM Cloud Pak for Multicloud Management Managed Service Content Runtime with docker engine 19.03.14 o...

CVE-2021-22203

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server...

CVE-2021-22197

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other...

CVE-2021-22197

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other...

CVE-2021-22201

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server...

CVE-2021-22197

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other...

Code injection

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server...

Cross site scripting

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name...

CVE-2021-22203

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other...

CVE-2021-22202

CVE-2021-22202 affects GitLab CE/EE (all prior versions) where an admin can be CSRF-ed via the API to System hooks. The issue is described across multiple sources (GitLab CVE entries, Red Hat/RH, OSV, Nessus notes, etc.) with the core flaw being CSRF in System hooks through the API when the victi...

CVE-2021-22198

CVE-2021-22198 affects GitLab CE/EE, from version 13.8 and above. The issue allows an authenticated user to delete incident metric images of public projects. The connected documents confirm the affected product and the exact action; they do not provide root cause details or explicit remediation s...

CVE-2021-22201

GitLab CE/EE CVE-2021-22201 affects all versions from 13.9. A crafted import file could read files on the server (arbitrary file read) during project import/export. Public details in the sources indicate affected ranges such as 13.9.x before 13.9.5 and 13.10.x before 13.10.1; remediation mentione...

CVE-2021-22203

Removed by vendor...

CVE-2021-22203

CVE-2021-22203 affects GitLab CE/EE; a specially crafted Wiki page could read arbitrary files on the server. Affected versions: 13.7.9–13.8.6, 13.9.x before 13.9.5, and 13.10.x before 13.10.1. Remediation: upgrade to patched releases (e.g., 13.8.7, 13.9.5, 13.10.1 or newer). Root cause: Wiki hand...