diff options
| author | Matthias Fechner <mfechner@FreeBSD.org> | 2022-02-04 16:21:33 +0000 |
|---|---|---|
| committer | Matthias Fechner <mfechner@FreeBSD.org> | 2022-02-04 16:21:33 +0000 |
| commit | 51bd707f5a4dfae7e520e8008d621d11286653ee (patch) | |
| tree | 9fcc752beba79bb6a4a095d6f0dc7b652727ce9d | |
| parent | 7dfc8cdef988819d523a35997cde458918fbe117 (diff) | |
security/vuxml: Document gitlab vulnerabilities
| -rw-r--r-- | security/vuxml/vuln-2022.xml | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index ae1795e6eed2..5ad891c4c81d 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,59 @@ + <vuln vid="3507bfb3-85d5-11ec-8c9c-001b217b3468"> + <topic>Gitlab -- multiple vulnerabilities</topic> + <affects> + <package> + <name>gitlab-ce</name> + <range><ge>14.7.0</ge><lt>14.7.1</lt></range> + <range><ge>14.6.0</ge><lt>14.6.4</lt></range> + <range><ge>0</ge><lt>14.5.4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Gitlab reports:</p> + <blockquote cite="https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/"> + <p>Arbitrary POST requests via special HTML attributes in Jupyter Notebooks</p> + <p>DNS Rebinding vulnerability in Irker IRC Gateway integration</p> + <p>Missing certificate validation for external CI services</p> + <p>Blind SSRF Through Project Import</p> + <p>Open redirect vulnerability in Jira Integration</p> + <p>Issue link was disclosing the linked issue</p> + <p>Service desk email accessible by project non-members</p> + <p>Authenticated users can search other users by their private email</p> + <p>"External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request</p> + <p>Deleting packages in bulk from package registries may cause table locks</p> + <p>Autocomplete enabled on specific pages</p> + <p>Possible SSRF due to not blocking shared address space</p> + <p>System notes reveals private project path when Issue is moved to a public project</p> + <p>Timeout for pages using Markdown</p> + <p>Certain branch names could not be protected</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2022-0427</cvename> + <cvename>CVE-2022-0425</cvename> + <cvename>CVE-2022-0123</cvename> + <cvename>CVE-2022-0136</cvename> + <cvename>CVE-2022-0283</cvename> + <cvename>CVE-2022-0390</cvename> + <cvename>CVE-2022-0373</cvename> + <cvename>CVE-2022-0371</cvename> + <cvename>CVE-2021-39943</cvename> + <cvename>CVE-2022-0477</cvename> + <cvename>CVE-2022-0167</cvename> + <cvename>CVE-2022-0249</cvename> + <cvename>CVE-2022-0344</cvename> + <cvename>CVE-2022-0488</cvename> + <cvename>CVE-2021-39931</cvename> + <url>https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/</url> + </references> + <dates> + <discovery>2022-02-03</discovery> + <entry>2022-02-04</entry> + </dates> + </vuln> + <vuln vid="e852f43c-846e-11ec-b043-3065ec8fd3ec"> <topic>chromium -- multiple vulnerabilities</topic> <affects> |