Authorization

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using...

CVE-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

CVE-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

CVE-2022-2459

An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to preven...

Code injection

An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to preven...

CVE-2022-2459

Removed by vendor...

CVE-2022-2459

GitLab Enterprise Edition (GitLab EE) is affected by CVE-2022-2459 in affected versions prior to 15.0.5, versions 15.1 before 15.1.4, and versions 15.2 before 15.2.1. Description: an issue could allow email-invited members to join a project even after the group-owner setting to prevent adding mem...

Exchange Backup Jobs Warning "Failed to find group owner account"

Challenge Backup jobs with Microsoft Exchange items may result in the warning message shown in both the Veeam Backup for Microsoft 365 console and the Veeam.Archiver.Proxy.log file. Processing mailbox $mailboxName completed with warning: Failed to find group owner account This appears in the...

CVE-2011-3145 mount.ecrpytfs_private sets group owner of /etc/mtab to user's primary group

When mount.ecrpytfsprivate before version 87-0ubuntu1.2 calls setreuid it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfsprivate...

Information Disclosure And Elevation Of Priveleges

Loopback is vulnerable to elevation of privilege attacks and information disclosure. This is possible because ACL relations are not enforced. This means that if a malicious user has user group relation, it may allow the group owner to view all user tokens in that group. They can then use that...

Code injection

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

DEBIAN-CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Organic Groups OG module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote authenticated users, with group owner permissions, to inject arbitrary web script or HTML via unspecified vectors...