Security Vulnerabilities - CVEs Published In 2022
An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL.
CVSS Score
4.7
EPSS Score
0.008
Published
2022-11-09
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
CVSS Score
7.3
EPSS Score
0.87
Published
2022-11-09
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
CVSS Score
3.5
EPSS Score
0.006
Published
2022-11-09
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
CVSS Score
6.7
EPSS Score
0.008
Published
2022-11-09
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.
CVSS Score
4.3
EPSS Score
0.007
Published
2022-11-09
Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score
6.5
EPSS Score
0.017
Published
2022-11-09
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS Score
7.8
EPSS Score
0.006
Published
2022-11-09
CVE-2022-41125
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Known exploited
CVSS Score
7.8
EPSS Score
0.03
Published
2022-11-09
CVE-2022-41128
Windows Scripting Languages Remote Code Execution Vulnerability
Known exploited
CVSS Score
8.8
EPSS Score
0.246
Published
2022-11-09
An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
CVSS Score
6.6
EPSS Score
0.011
Published
2022-11-09