Input validation

An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid...

CVE-2023-4658 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the Allowed to merge permission as a guest user, when granted t...

CVE-2023-4658

CVE-2023-4658 refers to an incorrect authorization in GitLab EE where a guest user could exploit a group-granted Allowed to merge permission. Affects GitLab EE versions from 8.13 up to, but not including, 16.4.3; 16.5 up to 16.5.3; and 16.6 up to 16.6.1, per multiple sources in the connected docu...

CVE-2023-4658 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the Allowed to merge permission as a guest user, when granted t...

CVE-2023-4912

CVE-2023-4912 affects GitLab EE: vulnerable on all versions 10.5–16.4.3, 16.5–16.5.3, and 16.6–16.6.1 due to client-side DoS from malicious mermaid diagram input. Connected sources indicate fixes in 16.4.3, 16.5.3, and 16.6.1 (GitLab EE/CE). Remediation: upgrade to the patched releases (e.g., 16....

CVE-2023-6033

Removed by vendor...

CVE-2023-6033 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

CVE-2023-6033

CVE-2023-6033 affects GitLab CE/EE: improper neutralization of input in Jira integration configuration enables cross-site scripting (XSS) by an attacker. Impact spans GitLab versions 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3. Documented impact is attacker-executed Java...

CVE-2023-6033 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

CVE-2023-5995

Concisely, CVE-2023-5995 affects GitLab Enterprise Edition (EE) versions 16.2–16.4.3, 16.5–16.5.3, and 16.6–16.6.1, where a vulnerability allows an attacker to abuse the policy bot and gain access to internal projects. The issue stems from improper handling of policy bot interactions, enabling un...

CVE-2023-4912

An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid...

CVE-2023-4912: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid...

CVE-2023-4658: Incorrect Authorization

An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the Allowed to merge permission as a guest user, when granted t...

CVE-2023-6033: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

PT-2023-32486 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.10 through 16.4.2 GitLab CE/EE versions 16.5 through 16.5.2 GitLab CE/EE versions 16.6 through 16.6.0 Description: The issue is related to improper neutralization of input in Jira integration configuration, allowing a...

CVE-2023-5995

An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects...

CVE-2023-5995: Incorrect Authorization

An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects...

open24.ee Cross Site Scripting vulnerability OBB-3786392

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-4379 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...

CVE-2023-4379: Incorrect Authorization

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...