CVE-2021-22172

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-22172

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-22172

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

Authorization

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-22172

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-22172

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-22172

CVE-2021-22172 arises from improper authorization in GitLab 12.8+ where a guest user in a private project can view tag data on the releases page. The issue is fixed in upstream GitLab releases: 13.6.6, 13.7.6, and 13.8.2. Affected component is GitLab’s releases/tag data access; root cause involve...

CVE-2021-22172

Removed by vendor...

CVE-2021-22172: Exposure of Sensitive Information to an Unauthorized Actor

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...

CVE-2021-21411: Incorrect Authorization

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2021-27195

Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic...

Authorization

Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic...

CVE-2021-27195

CVE-2021-27195 (Netop Vision Pro) is an Improper Authorization flaw that enables replay of authenticated teacher traffic to execute commands on student hosts. McAfee/ThreatPost: attackers can emulate a teacher, replay modified local network traffic, and perform remote command execution with Syste...

PT-2021-6603 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 and later Description: The issue is related to improper authorization, allowing guest users to create issues for Sentry errors and track their status. This could potentially enable a remote attacker to access...

PT-2021-17314

Name of the Vulnerable Software and Affected Versions: Netop Vision Pro versions up to and including 9.7.1 Description: The issue is related to an Improper Authorization vulnerability, which allows an attacker to replay network traffic. Recommendations: For versions up to and including 9.7.1,...

CVE-2021-25353: Improper Authorization

Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes application without permission via hijacking the PendingIntent...

CVE-2021-25355: Improper Authorization

Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingIntent...

CVE-2021-25352: Improper Authorization

Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the intent...

CVE-2021-27195: Incorrect Authorization

Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic...

CVE-2021-25354: Improper Authorization

Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink...