An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
| Max Base Score | 7.5 |
| Published | 2023-09-01 |
| Updated | 2023-09-07 |
| EPSS | 0.05% |
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.05% |
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.12% |
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified as external and may be used to access internal projects.
| Max Base Score | 7.2 |
| Published | 2023-09-01 |
| Updated | 2023-09-01 |
| EPSS | 0.07% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-07-13 |
| Updated | 2023-07-20 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-06-07 |
| Updated | 2023-06-14 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-06-07 |
| Updated | 2023-06-14 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.
| Max Base Score | 7.5 |
| Published | 2023-06-06 |
| Updated | 2023-06-13 |
| EPSS | 0.05% |
A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.
| Max Base Score | 7.5 |
| Published | 2023-04-05 |
| Updated | 2023-04-12 |
| EPSS | 0.05% |
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry.
| Max Base Score | 7.5 |
| Published | 2023-08-02 |
| Updated | 2023-08-04 |
| EPSS | 0.05% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
| Max Base Score | 7.5 |
| Published | 2023-02-13 |
| Updated | 2023-02-27 |
| EPSS | 0.05% |
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
| Max Base Score | 7.5 |
| Published | 2023-06-07 |
| Updated | 2023-06-14 |
| EPSS | 0.05% |
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group.
| Max Base Score | 7.3 |
| Published | 2023-03-09 |
| Updated | 2023-03-15 |
| EPSS | 0.08% |
In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
| Max Base Score | 7.5 |
| Published | 2023-01-27 |
| Updated | 2023-02-06 |
| EPSS | 0.05% |
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
| Max Base Score | 7.5 |
| Published | 2023-01-12 |
| Updated | 2023-01-18 |
| EPSS | 0.12% |
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
| Max Base Score | 7.5 |
| Published | 2023-02-13 |
| Updated | 2023-02-27 |
| EPSS | 0.05% |
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage.
| Max Base Score | 7.5 |
| Published | 2022-10-21 |
| Updated | 2022-10-21 |
| EPSS | 0.06% |
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
| Max Base Score | 7.5 |
| Published | 2023-01-12 |
| Updated | 2023-01-19 |
| EPSS | 0.05% |
Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab
| Max Base Score | 7.5 |
| Published | 2022-11-09 |
| Updated | 2022-11-11 |
| EPSS | 0.05% |
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.
| Max Base Score | 7.5 |
| Published | 2022-10-17 |
| Updated | 2022-10-20 |
| EPSS | 0.06% |
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
| Max Base Score | 7.3 |
| Published | 2022-11-09 |
| Updated | 2022-11-10 |
| EPSS | 0.42% |
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests
| Max Base Score | 7.3 |
| Published | 2022-10-17 |
| Updated | 2022-10-19 |
| EPSS | 0.08% |