BIT-GITLAB-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

BIT-GITLAB-2022-0136

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature...

BIT-GITLAB-2022-1111

A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages...

BIT-GITLAB-2023-3385 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

CVE-2021-22281 Zip Slip Vulnerability in B&R Automation Studio Project Import

: Relative Path Traversal vulnerability in B&R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: from 4.0 through 4.12...

GitLab 14.0 < 14.7.7 / 14.8.0 < 14.8.5 / 14.9 < 14.9.2 (CVE-2022-1111)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an...

SVGator – Add Animated SVG Easily < 1.2.5 - API Token Update/Deletion & Import Projects via CSRF

Description The plugin does not have CSRF checks when updating and deleting API token as well as importing projects, which could allow attackers to make logged in admins perform such actions via CSRF attacks...

CVE-2023-3385

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

CVE-2023-41886 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue...

OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack

Summary An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker...

Red Hat event_driven 日志信息泄露漏洞

Red Hat eventdriven is an event-driven architecture from Red Hat. Red Hat eventdriven suffers from a log information disclosure vulnerability that stems from an information disclosure vulnerability in the component Project Import...

Server-Side Request Forgery (SSRF)

gitlab is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists through the Project Import feature which allows an attacker to perform attacks...

Improper Privilege Management

Gitlab is vulnerable to Improper Privilege Management. The vulnerability is due to flowed permission validation which allowed group members with a developer role to elevate their privilege to a maintainer on projects they import...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles the project import/export feature. An attacker can exploit this vulnerability to obtain the private email addresses of users who have exported their projects...

CVE-2023-3385

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. A business logic error in Project Import under certain conditions may show an unauthorized user in the Access Granted column in the project membership pages, which allows an authenticated attacker to bypass authorizations...

GHSA-M88M-CRR9-JVQQ OpenRefine vulnerable to zip slip in project import

Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...

CVE-2023-29502

Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path...

Path traversal

Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path...

CVE-2023-29502

CVE-2023-29502 describes a path traversal vulnerability in PTC Vuforia Studio. A user can modify the resourceDirectory attribute in the appConfig.json file before importing a project into Vuforia to point to a different path, potentially impacting file access. The vulnerability is tied to the Vuf...