{"uuid": "468a877e-e4c5-4157-b6d3-61b4bc01c4f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22214", "type": "seen", "source": "https://t.me/cissp/4730", "content": "Threat_Research\n1. CI/CD: Pre-Auth Takeover of Build Pipelines in GoCD\nhttps://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover\n2. Vulnerabilities in FreeSWITCH 1.10.7\nhttps://www.rtcsec.com/article/killing-bugs-one-vulnerability-report-at-a-time\n\nexploit\n1. CVE-2021-22214:\nGitlab CI Lint API SSRF\nhttps://github.com/antx-code/CVE-2021-22214\n\n2. CVE-2021-42327:\nWIP kernel exploit for minor bug in amd gpu driver\nhttps://github.com/docfate111/CVE-2021-42327\n\nRed_Team_Tactics\n1. Stored XSS in Mermaid when viewing Markdown files (GitLab)\nhttps://hackerone.com/reports/1212822\n2. Bypass 4xx HTTP response status codes.\nBased on cURL.\nhttps://github.com/ivan-sincek/forbidden\n\nResearch\nEscalating XSS to Sainthood with Nagios\n(Example End-to-End Attack: NSCA)\nhttps://blog.grimm-co.com/2021/11/escalating-xss-to-sainthood-with-nagios.html\n]-> Scripts:\nhttps://github.com/grimm-co/NotQuite0DayFriday/tree/trunk/2021.11.02-nagios\n\nWLAN_Security\nBrakTooth: Patch Status, Vulnerabilities and SDK/Firmware Version of Affected Devices\nhttps://isc.sans.edu/forums/diary/Revisiting+BrakTooth+Two+Months+Later/27992", "creation_timestamp": "2026-09-01T17:00:36.438548Z"}