Vulnerabilities fixed in GitLab CE/EE

🗓️ 15 Nov 2024 12:29:35Reported by NCSCType

GitLab fixed CE/EE 16.0–17.5.2 vulnerabilities: API access, XSS without CSP, dashboard JavaScript, and Kubernetes agent access.

Reporter	Title	Published	Views	Family All 79
FreeBSD	Gitlab -- vulnerabilities	13 Nov 202400:00	–	freebsd
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of measures taken to protect the website structure, allowing attackers to inject arbitrary JavaScript code.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE is related to deficiencies in the authentication mechanism. This allows unauthorized users to gain unauthorized access to protected information.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of measures taken to protect the structure of web pages. This allows attackers to carry out XSS attacks.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Device OAuth protocol implementation on the software platform based on git for collaborative code development in GitLab EE/CE allows a perpetrator to gain unauthorized access to the API.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE involves exposing system data that is not authorized to be accessible within the controlled area. This allows attackers to disclose protected information.	2 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-10240	13 Nov 202414:08	–	circl
Circl	CVE-2024-7404	13 Nov 202414:08	–	circl
Circl	CVE-2024-8180	13 Nov 202414:08	–	circl
Circl	CVE-2024-8648	13 Nov 202414:08	–	circl