147 results · Clear filters · Feed
-
High 7.7
Improper Enforcement of Behavioral Workflow in GitLab
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
-
High 8.7CVE-2024-1451 EPSS 51%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of …
-
High 7.6
Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding chang…
-
High 7.3
Incorrect Authorization in GitLab
Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute sl…
-
High 7.4
Improper Certificate Validation in GitLab
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if the…
-
High 8.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
-
High 8.5
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to rea…
-
High 8.2
Incorrect Authorization in GitLab
An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer gro…
-
High 8.2
Execution with Unnecessary Privileges in GitLab
A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.
-
High 7.5
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending …
-
High 7.5CVE-2023-3364 EPSS 44%
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending…
-
High 7.5
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sendi…
-
High 8.7CVE-2023-2442 EPSS 96%
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions st…
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions sta…
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions star…
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions sta…
-
High 7.5
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x befo…
-
High 8.7CVE-2023-0050 EPSS 92%
An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting f…
-
High 7.7
Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers t…
-
High 7.3CVE-2022-3265 EPSS 87%
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to …
-
High 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.…
-
High 7.5
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions …
-
High 7.3
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an …
-
High 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 a…
-
High 7.5
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions startin…
-
High 7.3
An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.…
-
High 8.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions star…
-
High 7.5
An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4…
-
High 8.1CVE-2022-2230 EPSS 58%
A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14…
-
High 8.7
Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0…
-
High 8.7CVE-2022-1190 EPSS 88%
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 1…
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befo…
-
High 7.7
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows …
-
High 8.7
Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allow…
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting fr…
-
High 8.6
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possibl…
-
High 7.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions star…
-
High 7.7
A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13…
-
High 8.7CVE-2021-39906 EPSS 61%
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaS…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14…