{"vulnerability": "CVE-2021-2225", "sightings": [{"uuid": "90a08341-dde6-4946-b067-00ed7a28bb22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22257", "type": "seen", "source": "https://t.me/cibsecurity/29982", "content": "\u203c CVE-2021-22257 \u203c\n\nAn issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-05T18:30:30.000000Z"}, {"uuid": "4919fde2-0adb-4723-8bff-f5307480f586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22258", "type": "seen", "source": "https://t.me/cibsecurity/29981", "content": "\u203c CVE-2021-22258 \u203c\n\nThe project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-05T18:30:29.000000Z"}, {"uuid": "fcbe0990-40ff-477e-8d42-82be69975db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22250", "type": "seen", "source": "https://t.me/cibsecurity/27881", "content": "\u203c CVE-2021-22250 \u203c\n\nImproper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-25T22:26:00.000000Z"}, {"uuid": "c880cc13-66ad-4af7-9c9e-1371e3f58001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22256", "type": "seen", "source": "https://t.me/cibsecurity/27873", "content": "\u203c CVE-2021-22256 \u203c\n\nImproper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-25T22:25:47.000000Z"}, {"uuid": "b1daaaee-cc63-4d6b-b0f0-0d0422972a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22252", "type": "seen", "source": "https://t.me/cibsecurity/27727", "content": "\u203c CVE-2021-22252 \u203c\n\nA confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers\n\n? Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-24T00:23:25.000000Z"}, {"uuid": "f7a5ce0e-6602-4d52-842c-9ecbb7ebbb76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22253", "type": "seen", "source": "https://t.me/cibsecurity/27735", "content": "\u203c CVE-2021-22253 \u203c\n\nImproper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed\n\n? Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-24T00:23:37.000000Z"}, {"uuid": "ce3210d1-fdc4-48ce-a29e-713e162b0b40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-22251", "type": "seen", "source": "https://t.me/cibsecurity/27733", "content": "\u203c CVE-2021-22251 \u203c\n\nImproper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings\n\n? Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-24T00:23:34.000000Z"}]}