An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
Source: GitLab Inc.
Max CVSS
4.4
EPSS Score
N/A
Published
2024-05-23
Updated
2024-05-23
A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.
Source: GitLab Inc.
Max CVSS
8.0
EPSS Score
0.04%
Published
2024-05-23
Updated
2024-05-23
An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.
Source: GitLab Inc.
Max CVSS
5.7
EPSS Score
0.04%
Published
2024-05-09
Updated
2024-05-14
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.04%
Published
2024-05-09
Updated
2024-05-14
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.
Source: GitLab Inc.
Max CVSS
7.3
EPSS Score
0.04%
Published
2024-04-25
Updated
2024-04-25
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.04%
Published
2024-04-25
Updated
2024-04-25
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.
Source: GitLab Inc.
Max CVSS
8.7
EPSS Score
0.04%
Published
2024-04-12
Updated
2024-04-12
An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-05-23
Updated
2024-05-23
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.
Source: GitLab Inc.
Max CVSS
7.5
EPSS Score
0.04%
Published
2024-04-25
Updated
2024-04-25
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.07%
Published
2024-03-28
Updated
2024-03-28
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-05-09
Updated
2024-05-14
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-05-09
Updated
2024-05-14
An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.
Source: GitLab Inc.
Max CVSS
8.5
EPSS Score
0.04%
Published
2024-04-25
Updated
2024-04-25
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
Source: GitLab Inc.
Max CVSS
8.7
EPSS Score
0.04%
Published
2024-04-12
Updated
2024-04-12
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
N/A
Published
2024-05-23
Updated
2024-05-23
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.
Source: GitLab Inc.
Max CVSS
5.3
EPSS Score
0.05%
Published
2024-02-22
Updated
2024-03-04
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."
Source: GitLab Inc.
Max CVSS
8.7
EPSS Score
0.07%
Published
2024-02-22
Updated
2024-03-04
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.04%
Published
2024-04-25
Updated
2024-04-25
A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.05%
Published
2024-03-07
Updated
2024-03-07
An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation.
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.07%
Published
2024-02-12
Updated
2024-03-04
An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay`
Source: GitLab Inc.
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-02-07
Updated
2024-03-04
An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.05%
Published
2024-02-22
Updated
2024-03-04
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
Source: GitLab Inc.
Max CVSS
4.3
EPSS Score
0.05%
Published
2024-01-26
Updated
2024-01-31
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
Source: GitLab Inc.
Max CVSS
7.7
EPSS Score
0.07%
Published
2024-02-22
Updated
2024-03-04
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
Source: GitLab Inc.
Max CVSS
9.9
EPSS Score
0.07%
Published
2024-01-26
Updated
2024-01-31
993 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!