CVE-2021-22256

CVE-2021-22256 concerns GitLab CE/EE: improper authorization allowed guest users to create issues for Sentry errors and track status, affecting all versions since 12.6. Public records from Red Hat, OSV, NVD and related feeds confirm the issue exists in GitLab CE/EE and has concrete exploitation c...

GitLab security vulnerabilities

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE/EE 12.6 and...

CVE-2021-22256: Incorrect Authorization

Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status...

HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels

@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

Authorization

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131 Impala logs contain secrets

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

CVE-2021-28131 (Impala): The vulnerability arises because a 16-byte session secret is logged, enabling an authenticated user to hijack another user’s session and execute statements with privileges not held. Affected deployments with Apache Sentry, Apache Ranger, or audit logging may face privileg...

Sentry Hardware Sentry KM Information Disclosure Vulnerability

Hardware Sentry KM is a hardware device view from Sentry France. It takes hardware monitoring in TrueSight to a new level by providing a dedicated view in TrueSight Presentation Server. An information disclosure vulnerability exists in Hardware Sentry KM versions prior to 10.0.01, which stems fro...

CVE-2021-31791

In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command...

CVE-2021-31791

In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command...

CVE-2021-31791

In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command...

Command injection

In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command...

CVE-2021-31791

The CVE-2021-31791 issue affects Hardware Sentry KM prior to version 10.0.01 for BMC PATROL. The vulnerability stems from a failure/timeout during a command that could lead to disclosure of a plaintext password. The available connected documents confirm the affected product/version and the inform...

CVE-2021-31791

In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command...

PT-2021-19508

Name of the Vulnerable Software and Affected Versions Hardware Sentry KM versions prior to 10.0.01 for BMC PATROL Description A cleartext password may be discovered after a failure or timeout of a command. Recommendations For versions prior to 10.0.01, update to version 10.0.01 or later to resolv...