Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2021-11-17. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
A simple "image upload" could lead to RCE on a GitLab Server 😳 No login, no special access required. Let's break down how CVE-2021-22205 happened 🧵 https://t.co/oJsi4ncKG7
Post summary
The tweet announces a GitLab vulnerability (CVE-2021-22205) that permits remote code execution through unauthenticated image uploads, providing high-level details but no PoC, exploit code, or patch information.
4/ Key detail: CVE-2021-22204 = ExifTool CVE-2021-22205 = GitLab This vulnerability was rated CVSS 10.0 Critical.
Post summary
The post merely lists two CVEs with a CVSS 10.0 critical rating, providing minimal technical context but no info on exploits, patches, or active use.
El FBI incautó siete dominios de Flax Typhoon y siete países publicaron un aviso conjunto sobre Integrity Tech, la empresa china ligada al grupo: escanean con MicroScan (más de 1.300 scripts) y entran por ocho CVE viejas. Cinco entraron al KEV el 8, con plazo el domingo 11. Las ocho que más usan, según el aviso (vía BleepingComputer y The Hacker News): • ProFTPD CVE-2015-3306 • ISC BIND CVE-2015-5477 • Apache Struts CVE-2016-3081 • ONLYOFFICE Docs CVE-2021-3199 • Strapi CVE-2023-22894 • Bash (Shellshock) CVE-2014-6278 • Pulse Secure (Ivanti) CVE-2019-11510 • GitLab CVE-2021-22205 Las cinco primeras entraron al KEV el 8 de octubre; las otras tres ya estaban. Además: password spraying contra Exchange con la herramienta EBurst, robo de correos y de credenciales de Active Directory, SoftEther VPN para quedarse adentro y hasta un portal web para que terceros leyeran los correos robados sin entrar a las cuentas. Entre los dominios incautados están c0cc[.]cc (acceso a MicroScan) y outlook3650[.]com y linkedinns[.]net (entrega de malware de FishHub). Qué hacer: buscar esas ocho CVE en lo que tienes expuesto a internet (sí, cosas de 2015 siguen vivas), apagar servicios que nadie usa, exigir MFA en Exchange y Microsoft 365 y cruzar los indicadores del aviso con tus logs.
NØØT Ransomware Watch Classification: Critical CVE: CVE-2014-6278 Product: GNU — GNU Bash | Ivanti — Pulse Connect Secure | GitLab — Community and Enterprise Editions Summary: CISA confirms active exploitation of CVE-2014-6278, CVE-2019-11510, CVE-2021-22205 through its KEV catalog. Affected products include: GNU — GNU Bash, Ivanti — Pulse Connect Secure. CISA also records known ransomware campaign use. Evidence: Active exploitation confirmed by CISA KEV; Ransomware activity; state-sponsored activity; active exploitation; compromise; intrusion; IoCs Impact: CISA confirms active exploitation of CVE-2014-6278, CVE-2019-11510, CVE-2021-22205 through its KEV catalog. Affected products include: GNU — GNU Bash, Ivanti — Pulse Connect Secure. CISA also records known ransomware campaign use. Action: Apply CISA and vendor remediation guidance to affected systems immediately and identify exposed assets. Date: 08 October 2026 Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #GNU_GNU_Bash_Ivanti_Pulse_Connect_Secure_GitLab_Co #CVE_2014_6278 #ActiveExploitation #Exploit #Ransomware #CISAKEV
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gitlab | gitlab | - | - | - |
| App | gitlab | gitlab | - | - | - |