CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

UBUNTU-CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

UBUNTU-CVE-2021-39870

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call...

CVE-2021-39870

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call...

Design/Logic Flaw

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call...

Code injection

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

CVE-2021-22258 affects GitLab releases 8.9 and newer, where the project import/export feature could be exploited to obtain otherwise private email addresses. The provided connected documents confirm the vulnerable component/function (import/export), the underlying issue being exposure of private ...

CVE-2021-22258

Removed by vendor...

PT-2021-14920 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.9 and greater Description: The project import/export feature could be used to obtain otherwise private email addresses. Recommendations: For GitLab versions 8.9 and greater, consider restricting access to the project...

The software’s vulnerability involves providing a web interface for accessing GNU Mailman v3 archives and interacting with Hyperkitty lists. This vulnerability allows an attacker to gain access to confidential data.

The vulnerability of the software that provides a web interface for accessing GNU Mailman v3 archives and interacting with Hyperkitty lists is related to an error during the import of private distribution list archives, which later became publicly accessible. Exploiting this vulnerability could...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

CVE-2021-41595

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the filename parameter of the Step3 import functionality...

CVE-2021-41596

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality...

CVE-2021-41595

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the filename parameter of the Step3 import functionality...

CVE-2021-39871

In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call...

Information disclosure

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the filename parameter of the Step3 import functionality...

Code injection

In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call...