https://db.gcve.eu/sightings/feed 2026-07-22T17:55:39.942621+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/ce11ad70-d717-4d91-a925-1847acc215be/export 2026-07-22T17:55:39.967083+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "ce11ad70-d717-4d91-a925-1847acc215be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22573", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12659", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-22573\n\ud83d\udd25 CVSS Score: 8.7 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above\n\ud83d\udccf Published: 2022-05-03T15:45:12.000Z\n\ud83d\udccf Modified: 2025-04-21T13:54:18.220Z\n\ud83d\udd17 References:\n1. https://github.com/googleapis/google-oauth-java-client/pull/872", "creation_timestamp": "2025-04-21T14:02:18.000000Z"} 2025-04-21T14:02:18+00:00 https://db.gcve.eu/sighting/a3e01333-d1f0-4283-b139-5133c8f6d9ca/export 2026-07-22T17:55:39.969464+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "a3e01333-d1f0-4283-b139-5133c8f6d9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22572", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12656", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-22572\n\ud83d\udd25 CVSS Score: 5.5 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n\ud83d\udd39 Description: On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969\n\ud83d\udccf Published: 2022-03-29T15:05:19.000Z\n\ud83d\udccf Modified: 2025-04-21T13:54:59.936Z\n\ud83d\udd17 References:\n1. https://github.com/google/data-transfer-project/pull/969\n2. https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjg", "creation_timestamp": "2025-04-21T14:02:15.000000Z"} 2025-04-21T14:02:15+00:00 https://db.gcve.eu/sighting/fb2ab0ea-acc2-4ab2-9f65-4409dc39c099/export 2026-07-22T17:55:39.969597+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "fb2ab0ea-acc2-4ab2-9f65-4409dc39c099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22571", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12654", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-22571\n\ud83d\udd25 CVSS Score: 5.5 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)\n\ud83d\udd39 Description: A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above.\n\ud83d\udccf Published: 2022-03-18T11:05:11.000Z\n\ud83d\udccf Modified: 2025-04-21T13:55:18.219Z\n\ud83d\udd17 References:\n1. https://github.com/google/sa360-webquery-bigquery/pull/15\n2. https://github.com/google/sa360-webquery-bigquery/releases/tag/v1.0.3\n3. https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7fjx-657r-9r5h", "creation_timestamp": "2025-04-21T14:02:13.000000Z"} 2025-04-21T14:02:13+00:00 https://db.gcve.eu/sighting/956040f9-053c-48e4-9b6e-e5b8d3d106ef/export 2026-07-22T17:55:39.969702+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "956040f9-053c-48e4-9b6e-e5b8d3d106ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22570", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/12647", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2021-22570\n\ud83d\udd25 CVSS Score: 6.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.\n\ud83d\udccf Published: 2022-01-26T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-21T13:56:58.459Z\n\ud83d\udd17 References:\n1. https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0\n2. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFX6KPNOFHYD6L4XES5PCM3QNSKZBOTQ/\n3. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DVUZPALAQ34TQP6KFNLM4IZS6B32XSA/\n4. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTWVQRB5OCCTMKEQFY5MYED3DXDVSLP/\n5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BTRGBRC5KGCA4SK5MUNLPYJRAGXMBIYY/\n6. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/\n7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/\n8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/\n9. https://www.oracle.com/security-alerts/cpuapr2022.html\n10. https://security.netapp.com/advisory/ntap-20220429-0005/\n11. https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html", "creation_timestamp": "2025-04-21T14:02:01.000000Z"} 2025-04-21T14:02:01+00:00 https://db.gcve.eu/sighting/144e842d-a630-4948-9cb9-8551520ef442/export 2026-07-22T17:55:39.969803+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "144e842d-a630-4948-9cb9-8551520ef442", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22573", "type": "seen", "source": "https://t.me/arpsyndicate/4568", "content": "#ExploitObserverAlert\n\nCVE-2021-22573\n\nDESCRIPTION: Exploit Observer has 10 entries in 2 file formats related to CVE-2021-22573. The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above\n\nFIRST-EPSS: 0.000570000\nNVD-IS: 5.2\nNVD-ES: 2.1\nARPS-EXPLOITABILITY: 0.5856688", "creation_timestamp": "2024-04-12T08:45:22.000000Z"} 2024-04-12T08:45:22+00:00 https://db.gcve.eu/sighting/e0f4a5b6-f994-4baf-b12b-37cdf4628f78/export 2026-07-22T17:55:39.969891+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "e0f4a5b6-f994-4baf-b12b-37cdf4628f78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22573", "type": "seen", "source": "https://t.me/cKure/9574", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-22573: High-Severity Bug Reported in Google's OAuth Client Library for Java.\n\nhttps://thehackernews.com/2022/05/high-severity-bug-reported-in-googles.html", "creation_timestamp": "2022-05-21T06:12:07.000000Z"} 2022-05-21T06:12:07+00:00 https://db.gcve.eu/sighting/cad1187a-9dd3-491e-931a-6e9695f29790/export 2026-07-22T17:55:39.969975+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "cad1187a-9dd3-491e-931a-6e9695f29790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22573", "type": "seen", "source": "https://t.me/cibsecurity/41833", "content": "\u203c CVE-2021-22573 \u203c\n\nThe vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-03T20:34:05.000000Z"} 2022-05-03T20:34:05+00:00 https://db.gcve.eu/sighting/9d37536c-0e83-409f-b320-cae056e4e18f/export 2026-07-22T17:55:39.970062+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "9d37536c-0e83-409f-b320-cae056e4e18f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22572", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/39747", "content": "\u203c CVE-2021-22572 \u203c\n\nOn unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-29T18:41:19.000000Z"} 2022-03-29T18:41:19+00:00 https://db.gcve.eu/sighting/22afb8ef-a448-4dd8-9e82-301206d4dabc/export 2026-07-22T17:55:39.970157+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "22afb8ef-a448-4dd8-9e82-301206d4dabc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22571", "type": "seen", "source": "https://t.me/cibsecurity/39193", "content": "\u203c CVE-2021-22571 \u203c\n\nA local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T14:06:24.000000Z"} 2022-03-18T14:06:24+00:00 https://db.gcve.eu/sighting/7ef612de-7766-40c1-9bac-973465bf9ea2/export 2026-07-22T17:55:39.970240+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "7ef612de-7766-40c1-9bac-973465bf9ea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22570", "type": "seen", "source": "https://t.me/cibsecurity/36302", "content": "\u203c CVE-2021-22570 \u203c\n\nNullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-26T16:19:33.000000Z"} 2022-01-26T16:19:33+00:00