CVE-2022-0167
published 2022-07-01CVE-2022-0167: An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.71%
49.1th percentile
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 15.10.8+ds1-2 (sid) | gitlab 15.10.8+ds1-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.0.0 < 14.4.5 | 14.4.5 |
| gitlab | gitlab | >= 14.5.0 < 14.5.3 | 14.5.3 |
| gitlab | gitlab | >= 14.6.0 < 14.6.2 | 14.6.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
cisa8.8HIGH
vendor_debian3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2022-0167: An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all v
vendor_gitlab·2022-07-01·CVSS 3.1
CVE-2022-0167 [LOW] CWE-79 CVE-2022-0167: An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all v
CVE-2022-0167: An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.
CISA
Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
cisa·2022-03-03·CVSS 8.8
CVE-2018-0167 [HIGH] CWE-119 Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Vulnerability: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
Affected: Cisco IOS, XR, and XE Software
There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-0167
Remediation Due Date: 2022-03-17
Debian
CVE-2022-0167: gitlab - An issue has been discovered in GitLab affecting all versions starting from 14.0...
vendor_debian·2022·CVSS 3.1
CVE-2022-0167 [LOW] CVE-2022-0167: gitlab - An issue has been discovered in GitLab affecting all versions starting from 14.0...
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.
Scope: local
sid: resolved (fixed in 15.10.8+ds1-2)
CISA
Microsoft Win32k Privilege Escalation Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2016-0167 [HIGH] CWE-264 Microsoft Win32k Privilege Escalation Vulnerability
Vulnerability: Microsoft Win32k Privilege Escalation Vulnerability
Affected: Microsoft Win32k
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-0167
Remediation Due Date: 2022-05-03
GHSA
GHSA-gfj2-5hv5-w3x2: An issue has been discovered in GitLab affecting all versions starting from 14
ghsa_unreviewed·2022-07-02
CVE-2022-0167 [MEDIUM] CWE-79 GHSA-gfj2-5hv5-w3x2: An issue has been discovered in GitLab affecting all versions starting from 14
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-01
Published