{"metadata": {"vulnerability": "CVE-2024-9773", "count": 30, "kinds": {"milestone": 9, "sighting": 3, "kev": 0, "other": 18}}, "data": [{"timestamp": "2024-10-09T21:01:41.384Z", "date_only": false, "value": "2024-10-09T21:01:41.384Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-9773", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0100", "record": "NCSC-2025-0100", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-03-26T00:00:00Z", "date_only": true, "value": "2025-03-26", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0248", "record": "CERTFR-2025-AVI-0248", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2025-03-27T00:00:00Z", "date_only": false, "value": "2025-03-27T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0248", "record": "CERTFR-2025-AVI-0248", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2025-03-27T10:37:44.265Z", "date_only": false, "value": "2025-03-27T10:37:44.265+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-03-27T12:31:27.475Z", "date_only": false, "value": "2025-03-27T12:31:27.475Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-9773", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-03-27T12:31:27.475Z", "date_only": false, "value": "2025-03-27T12:31:27.475Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2024-9773", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-27T13:07:31.748Z", "date_only": false, "value": "2025-03-27T13:07:31.748921Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-9773", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-03-27T13:07:31.748Z", "date_only": false, "value": "2025-03-27T13:07:31.748921Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9773", "record": "FKIE_CVE-2024-9773", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-03-27T13:07:40.267Z", "date_only": false, "value": "2025-03-27T13:07:40.267Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-9773", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-27T13:07:40.267Z", "date_only": false, "value": "2025-03-27T13:07:40.267Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-9773", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-27T13:15:00Z", "date_only": false, "value": "2025-03-27T13:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2024-9773", "record": "UBUNTU-CVE-2024-9773", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-27T13:15:35Z", "date_only": false, "value": "2025-03-27T13:15:35Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-23JJ-XC4C-C6GR", "record": "GHSA-23JJ-XC4C-C6GR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-03-27T13:15:35.523Z", "date_only": false, "value": "2025-03-27T13:15:35.523", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9773", "record": "FKIE_CVE-2024-9773", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-27T14:49:34.316Z", "date_only": false, "value": "2025-03-27T14:49:34.316050Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0100", "record": "NCSC-2025-0100", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-03-27T14:49:34.316Z", "date_only": false, "value": "2025-03-27T14:49:34.316050Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0100", "record": "NCSC-2025-0100", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-27T14:49:34.316Z", "date_only": false, "value": "2025-03-27T14:49:34.316050Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0100", "record": "NCSC-2025-0100", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2025-03-27T14:58:28Z", "date_only": false, "value": "2025-03-27T14:58:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/21278", "record": "CVE-2024-9773", "field": "creation_timestamp", "uuid": "2a304ddc-5bd9-4e50-87d7-dbe2f3109479", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-9773 - GitLab Harbor Registry Command Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-9773 \nPublished : March 27, 2025, 1:15 p.m. | 14\u00a0minutes ago \nDescription : An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI. \nSeverity: 3.7 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"27 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/21278"}, {"timestamp": "2025-03-27T15:31:07Z", "date_only": false, "value": "2025-03-27T15:31:07Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-23JJ-XC4C-C6GR", "record": "GHSA-23JJ-XC4C-C6GR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-27T15:31:08Z", "date_only": false, "value": "2025-03-27T15:31:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-23JJ-XC4C-C6GR", "record": "GHSA-23JJ-XC4C-C6GR", "field": "modified", "linked_record": true}, {"timestamp": "2025-03-29T07:12:34.592Z", "date_only": false, "value": "2025-03-29T07:12:34.592Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2024-9773", "record": "BIT-GITLAB-2024-9773", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-10-24T05:06:47Z", "date_only": false, "value": "2025-10-24T05:06:47Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2024-9773", "record": "UBUNTU-CVE-2024-9773", "field": "modified", "linked_record": true}, {"timestamp": "2026-06-17T08:25:13.980Z", "date_only": false, "value": "2026-06-17T08:25:13.980", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9773", "record": "FKIE_CVE-2024-9773", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2024-9773", "record": "BIT-GITLAB-2024-9773", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-06T15:09:08Z", "date_only": false, "value": "2026-10-06T15:09:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pentestnotes/252", "record": "CVE-2024-9773", "field": "creation_timestamp", "uuid": "bb1a4049-93e9-4598-a906-00da47999c59", "content": "\u0421\u043e\u0431\u0440\u0430\u043b GitLab \u0432\u0438\u0434\u0435\u043e PoC's  \ud83d\udd0d\n\n\u041f\u0440\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 CVE \u043f\u043e\u0434 GitLab \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 PoC \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437 \u043d\u0438\u0445. \u0417\u0430\u043b\u0438\u043b \u0442\u0430\u043a\u0438\u0435 \u043a\u0435\u0439\u0441\u044b \u043a \u0441\u0435\u0431\u0435 \u043d\u0430 YouTube, \u0432\u0434\u0440\u0443\u0433 \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0436\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u0441\u044f. \n\n\u0418\u0418\u0448\u043a\u0438 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u0441\u0442\u0430\u0442\u0438, \u0432\u043e\u043e\u0431\u0449\u0435 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u0438 CVE \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e proof of concept. \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f)\n\nRCE / command injection\n\u27a1\ufe0f CVE-2022-0751 - \u041d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u0430\u044f \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Gitlab.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0436\u0435\u0440\u0442\u0432\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\u27a1\ufe0f CVE-2023-1708 - \u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\n\u27a1\ufe0f CVE-2024-8402 - Maintainer \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e Google integration, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438.\n\u27a1\ufe0f CVE-2024-9773 - shell injection \u0447\u0435\u0440\u0435\u0437 Harbor project name / helper scripts\n\u27a1\ufe0f CVE-2024-8640 - Reverse shell with root access to analytics Cube instance\n\nSSRF\n\u27a1\ufe0f CVE-2024-9870 - Full SSRF \u0447\u0435\u0440\u0435\u0437 Workspaces\n\u27a1\ufe0f CVE-2022-4335 - Blind SSRF \u043d\u0430 repository mirroring (DNS rebinding)\n\u27a1\ufe0f CVE-2021-22179 - SSRF \u0432 webhook / outbound requests\n\u27a1\ufe0fCVE-2025-6454 - CRLF Injection in Webhook custom header could lead to blind SSRF\n\u27a1\ufe0fCVE-2024-8977 - Full read SSRF\n\nXSS\n\u27a1\ufe0f CVE-2024-8312 - Stored XSS with CSP bypass\n\u27a1\ufe0f CVE-2025-7734 - Stored XSS in blob viewer\n\nDoS\n\u27a1\ufe0f CVE-2026-1456 - DoS \u0447\u0435\u0440\u0435\u0437 tasks / GraphQL-ish \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443\n\u27a1\ufe0f CVE-2026-1458 - DoS + path traversal \u0432 \u0442\u043e\u043c \u0436\u0435 \u0434\u0443\u0445\u0435\n\u27a1\ufe0f CVE-2024-8177 - Harbor DoS\n\u27a1\ufe0f CVE-2024-12379 - \u0441\u0435\u0440\u0438\u044f screen recordings \u043f\u043e\u0434 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439\n\n\u041f\u0440\u043e\u0447\u0435\u0435\n\u27a1\ufe0f CVE-2026-1230 - \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u043c\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438\n\u27a1\ufe0f CVE-2024-6502 - \u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 GitLab \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u0437 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.\n\u27a1\ufe0f CVE-2024-8970 - Account takeover\n\u27a1\ufe0f CVE-2021-22203 - Arbitrary file read\n\n\ud83d\udcab @pentestnotes", "url": "https://t.me/pentestnotes/252"}, {"timestamp": "2026-10-07T09:16:13Z", "date_only": false, "value": "2026-10-07T09:16:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/6361", "record": "CVE-2024-9773", "field": "creation_timestamp", "uuid": "dc19c7e1-0def-4b75-b525-d08ee12a2a8e", "content": "\u0421\u043e\u0431\u0440\u0430\u043b GitLab \u0432\u0438\u0434\u0435\u043e PoC's  \ud83d\udd0d\n\n\u041f\u0440\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 CVE \u043f\u043e\u0434 GitLab \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 PoC \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437 \u043d\u0438\u0445. \u0417\u0430\u043b\u0438\u043b \u0442\u0430\u043a\u0438\u0435 \u043a\u0435\u0439\u0441\u044b \u043a \u0441\u0435\u0431\u0435 \u043d\u0430 YouTube, \u0432\u0434\u0440\u0443\u0433 \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0436\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u0441\u044f. \n\n\u0418\u0418\u0448\u043a\u0438 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u0441\u0442\u0430\u0442\u0438, \u0432\u043e\u043e\u0431\u0449\u0435 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u0438 CVE \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e proof of concept. \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f)\n\nRCE / command injection\n\u27a1\ufe0f CVE-2022-0751 - \u041d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u0430\u044f \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Gitlab.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0436\u0435\u0440\u0442\u0432\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\u27a1\ufe0f CVE-2023-1708 - \u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\n\u27a1\ufe0f CVE-2024-8402 - Maintainer \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e Google integration, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438.\n\u27a1\ufe0f CVE-2024-9773 - shell injection \u0447\u0435\u0440\u0435\u0437 Harbor project name / helper scripts\n\u27a1\ufe0f CVE-2024-8640 - Reverse shell with root access to analytics Cube instance\n\nSSRF\n\u27a1\ufe0f CVE-2024-9870 - Full SSRF \u0447\u0435\u0440\u0435\u0437 Workspaces\n\u27a1\ufe0f CVE-2022-4335 - Blind SSRF \u043d\u0430 repository mirroring (DNS rebinding)\n\u27a1\ufe0f CVE-2021-22179 - SSRF \u0432 webhook / outbound requests\n\u27a1\ufe0fCVE-2025-6454 - CRLF Injection in Webhook custom header could lead to blind SSRF\n\u27a1\ufe0fCVE-2024-8977 - Full read SSRF\n\nXSS\n\u27a1\ufe0f CVE-2024-8312 - Stored XSS with CSP bypass\n\u27a1\ufe0f CVE-2025-7734 - Stored XSS in blob viewer\n\nDoS\n\u27a1\ufe0f CVE-2026-1456 - DoS \u0447\u0435\u0440\u0435\u0437 tasks / GraphQL-ish \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443\n\u27a1\ufe0f CVE-2026-1458 - DoS + path traversal \u0432 \u0442\u043e\u043c \u0436\u0435 \u0434\u0443\u0445\u0435\n\u27a1\ufe0f CVE-2024-8177 - Harbor DoS\n\u27a1\ufe0f CVE-2024-12379 - \u0441\u0435\u0440\u0438\u044f screen recordings \u043f\u043e\u0434 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439\n\n\u041f\u0440\u043e\u0447\u0435\u0435\n\u27a1\ufe0f CVE-2026-1230 - \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u043c\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438\n\u27a1\ufe0f CVE-2024-6502 - \u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 GitLab \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u0437 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.\n\u27a1\ufe0f CVE-2024-8970 - Account takeover\n\u27a1\ufe0f CVE-2021-22203 - Arbitrary file read\n\n\ud83d\udcab @pentestnotes", "url": "https://t.me/poxek/6361"}], "metrics": {"as_of": "2026-11-06T19:55:20.261Z", "anchors": {"origin": {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 50964920.261694, "hours": 14156.922294914999, "days": 589.871762288125, "min_seconds": 50964920.261694, "max_seconds": 50964920.261694, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-26T23:00:00Z", "date_only": false, "value": "2025-03-26T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0643", "record": "WID-SEC-W-2025-0643", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-06T19:55:20.261Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}