Input validation

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2023-5933

CVE-2023-5933 affects GitLab CE/EE. The issue is in the handling of user name input, where improper input sanitization enables arbitrary API PUT requests. Affected versions are all releases after 13.7 and before 16.6.6, versions 16.7 before 16.7.4, and versions 16.8 before 16.8.1. The reference d...

CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2024-0402

CVE-2024-0402: A path traversal flaw in GitLab CE/EE allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. Affected versions are 16.0–16.0.x up to 16.6.5, 16.7.x up to 16.7.3, and 16.8.x up to 16.8.0. Exploitation details are not provi...

CVE-2024-0402

Removed by vendor...

CVE-2023-6159: Inefficient Regular Expression Complexity

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...

CVE-2023-5933: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2024-0402: Improper Limitation of a Pathname to a Restricted Directory

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace...

PT-2024-1870 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.4 through 16.7.5 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0 Description: An issue has been discovered in GitLab EE, where users with the Guest role can change Custom dashboard projects...

open24.ee Cross Site Scripting vulnerability OBB-3841851

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-5356

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits...

CVE-2023-2030

CVE-2023-2030 affects GitLab CE/EE versions from 12.2 up to 16.5.5 (and 16.6 up to 16.6.3, 16.7 up to 16.7.1). The issue allows an attacker to potentially modify the metadata of signed commits. The vulnerability’s CVSS3.1 base score is 5.3 (MEDIUM) with network attack vector, and no privileges re...

CVE-2023-4812 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge...

CVE-2023-4812 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge...

CVE-2023-4812

CVE-2023-4812 describes an Incorrect Authorization issue in GitLab EE. Affected releases include all 15.3+ through 16.5.5, 16.6.0 through 16.6.3, and 16.7.0 through 16.7.1. The vulnerability allows bypassing the CODEOWNERS approval by adding changes to a previously approved merge request, potenti...

CVE-2023-5356 Incorrect Authorization in GitLab

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user...

CVE-2023-7028 Weak Password Recovery Mechanism for Forgotten Password in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

CVE-2023-7028

GitLab CE/EE versions affected are vulnerable to an improper access-control allowing password-reset emails to be sent to unverified addresses, enabling account takeover. CISA KEV notes active exploitation; PoCs and public references exist (Exploit-DB PoC for GitLab