4194 matches found
Design/Logic Flaw
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the...
CVE-2022-4037
Removed by vendor...
CVE-2022-4037
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth...
CVE-2022-3573
GitLab CE/EE is vulnerable to a cross-site scripting (XSS) flaw affecting versions 15.4 before 15.5.7 , 15.6 before 15.6.4 , and 15.7 before 15.7.2 . The root cause is the improper filtering of query parameters in the wiki changes page, which allows an attacker to execute arbitrary JavaScript on ...
CVE-2022-4167
Technical details (affected products/versions, root cause, remediation) are not publicly provided in the connected documents; monitor for updates.
CVE-2022-3514
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...
CVE-2022-3514
CVE-2022-3514 affects GitLab CE/EE, with vulnerable ranges: GitLab versions 6.6 through 15.5.6, 15.6.0 through 15.6.3, and 15.7.0 through 15.7.1. The issue stems from a regex handling in the submodule URL parser, which can be exploited to cause a Denial of Service on a GitLab instance. The availa...
CVE-2022-3613
The CVE-2022-3613 entry affects GitLab CE/EE: affected versions are all before 15.5.7, 15.6 before 15.6.4, and 15.7 before 15.7.2. The root cause is a crafted Prometheus Server query that can cause high resource consumption, leading to a Denial of Service. The provided connected documents confirm...
CVE-2022-4037: Concurrent Execution using Shared Resource with Improper Synchronization
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth...
CVE-2022-4365: Incorrect Permission Assignment for Critical Resource
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error...
CVE-2022-4167: Incorrect Authorization
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them...
CVE-2022-4342
CVE-2022-4342 affects GitLab CE/EE versions: 15.1–15.5.6 (up to 15.5.7 noted by some sources), 15.6.x prior to 15.6.4, and 15.7.x prior to 15.7.2. The issue allows a malicious Maintainer to leak masked webhook secrets by changing the webhook target URL. Public sources corroborate the basic descri...
CVE-2022-4365
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error...
CVE-2023-0042: URL Redirection to Untrusted Site
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols...
CVE-2022-3514: Inefficient Regular Expression Complexity
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...
CVE-2023-0042
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols...
CVE-2022-3514
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...
CVE-2022-4365
Removed by vendor...