139 results · Clear filters · Feed
-
Low 3.5
Business Logic Errors in GitLab
An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.
-
Low 2.7
Improper Control of Resource Identifiers ('Resource Injection') in GitLab
A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.
-
Low 3.0
Uncontrolled Search Path Element in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
-
Low 2.7
Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group mem…
-
Low 3.8
Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.
-
Low 3.1
Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.
-
Low 3.1
Uncontrolled Resource Consumption in GitLab
DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.
-
Low 3.7
Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privat…
-
Low 3.5
Improper Verification of Cryptographic Signature in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.
-
Low 2.0
Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge request…
-
Low 3.7
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the `super_sidebar_logged_out` feature flag ena…
-
Low 3.0
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to …
-
Low 3.1
Missing Authorization in GitLab
An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak …
-
Low 3.1
Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your…
-
Low 3.5
Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels …
-
Low 2.6
URL Redirection to Untrusted Site in GitLab
An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a differen…
-
Low 2.7
Missing Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.
-
Low 3.1
Generation of Error Message Containing Sensitive Information in GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for group…
-
Low 3.9
Insertion of Sensitive Information into Log File in GitLab
An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was se…
-
Low 3.5
Exposure of Private Personal Information to an Unauthorized Actor in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user …
-
Low 3.1
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in…
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions star…
-
Low 3.1
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15…
-
Low 3.7
An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and…
-
Low 3.1
An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 …
-
Low 3.1
An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting …
-
Low 2.7
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 befo…
-
Low 3.5
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 al…
-
Low 3.5
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior…
-
Low 3.5
An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4,…
-
Low 3.1
Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5…
-
Low 2.7
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting f…
-
Low 3.5
A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prio…
-
Low 3.5
Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions s…
-
Low 2.7
An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4,…
-
Low 3.7
An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 befo…
-
Low 2.2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions start…
-
Low 3.5
A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions start…
-
Low 3.5
An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starti…