CVE-2021-41077

CVE-2021-41077 concerns a Travis CI vulnerability observed during 2021-09-03 to 2021-09-10, where the activation/build process could cause secret data (e.g., signing keys, credentials, API tokens) to be exposed to unauthorized actors that forked public repositories. The issue stemmed from builds ...

CVE-2021-41077: Missing Authorization

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

PT-2021-23070

Name of the Vulnerable Software and Affected Versions Travis CI versions 2021-09-03 through 2021-09-10 Description The activation process in Travis CI causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. This allows an unauthorized actor...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

Authorization

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

Removed by vendor...

CVE-2021-22247

The CVE concerns GitLab CE/EE (all versions since 13.0) with improper authorization that allows guests in private projects to view CI/CD analytics. Multiple connected sources (e.g., Red Hat CVE page, OSV, NVD, and OSV Ubuntu/NASL references) corroborate the issue. The root cause details beyond “i...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247: Incorrect Authorization

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22252

CVE-2021-22252 describes a logic issue in GitLab CE/EE where a confusion between tag and branch names since version 13.7 allowed a Developer to access protected CI variables that should be Maintainer-only. Affected: GitLab CE/EE, all versions since 13.7. Root cause: misinterpretation between tag ...

CVE-2021-22252

Removed by vendor...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22252: Undefined Security Weakness

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...