CVE-2024-8311

Removed by vendor...

CVE-2024-4472 Insertion of Sensitive Information into Log File in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs...

CVE-2024-4472

Removed by vendor...

CVE-2024-4472 Insertion of Sensitive Information into Log File in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs...

CVE-2024-4472

CVE-2024-4472 affects GitLab CE/EE; vulnerable versions include all from 16.5 up to 17.1.7, 17.2 up to 17.2.5, and 17.3 up to 17.3.2, where dependency proxy credentials are retained in GraphQL logs. The issue’s root cause is credentials leakage in GraphQL log handling. Remediation is to apply the...

CVE-2024-6678

Removed by vendor...

CVE-2024-6678 Authentication Bypass by Spoofing in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances...

CVE-2024-6678

GitLab CE/EE vulnerable in versions from 8.14 up to 17.1.7, from 17.2 up to 17.2.5, and from 17.3 up to 17.3.2. The issue allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances. The affected components are GitLab pipelines; root cause details are not provided in...

CVE-2024-8641 Privilege Context Switching Error in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CIJOBTOKEN to obtain a GitLab session token belonging to the victim...

CVE-2024-8641

GitLab CVE-2024-8641 affects GitLab CE/EE versions 13.7 to before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker who has a victim’s CI_JOB_TOKEN could obtain the victim’s GitLab session token, enabling session hijacking. Remediation is available in patched releases: upgrade to Gi...

CVE-2024-8640

An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server...

CVE-2024-8754

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is...

CVE-2024-8635

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy UR...

CVE-2024-4612

An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow...

CVE-2024-2743

An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables...

CVE-2024-8631

CVE-2024-8631 describes a privilege escalation in GitLab EE where a user with the Admin Group Member custom role could elevate privileges to other custom roles. Affected: GitLab EE versions starting from 16.6 up to before 17.1.7; 17.2 up to before 17.2.5; 17.3 up to before 17.3.2. Remediation per...

CVE-2024-8631

Removed by vendor...

CVE-2024-8635

CVE-2024-8635 is a server-side request forgery (SSRF) in GitLab Enterprise Edition (EE). Affected: GitLab EE versions starting 16.8 up to but not including 17.1.7, 17.2 up to but not including 17.2.5, and 17.3 up to but not including 17.3.2. Root cause: abuse of a custom Maven Dependency Proxy UR...

CVE-2024-8635

Removed by vendor...

CVE-2024-8635 Server-Side Request Forgery (SSRF) in GitLab

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy UR...