CVE-2022-3726

CRITICAL Year: 2022
CVSS v3 Score
9.0
Critical
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account.

Related Vulnerabilities

CVE-2016-3454

CRITICAL
CVSS:9.0(Critical)

Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown...

NVD-CWE-Other2016

CVE-2016-3609

CRITICAL
CVSS:9.0(Critical)

Unspecified vulnerability in the OJVM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via ...

NVD-CWE-Other2016

CVE-2016-5528

CRITICAL
CVSS:9.0(Critical)

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulne...

NVD-CWE-Other2016

CVE-2017-0021

CRITICAL
CVSS:9.0(Critical)

Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka "Hyper-V System Data Stru...

NVD-CWE-Other2017

CVE-2017-10102

CRITICAL
CVSS:9.0(Critical)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Diffi...

NVD-CWE-Other2017

CVE-2017-2882

CRITICAL
CVSS:9.0(Critical)

An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the device to overwrite sensitive file...

NVD-CWE-Other2017