CVE-2022-0488

Removed by vendor...

CVE-2022-0427

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover...

CVE-2022-0751

Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands...

CVE-2022-0371

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails...

CVE-2022-0371

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails...

CVE-2022-0371

Removed by vendor...

CVE-2022-0549

CVE-2022-0549 affects GitLab CE/EE; versions before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2 are vulnerable. Under certain conditions, the REST API could allow unprivileged users to add other users to groups, contrary to Web UI constraints. Root cause: access control issue. Impact: unau...

CVE-2022-0735

CVE-2022-0735 — GitLab CE/EE information disclosure : Affects GitLab CE/EE versions 12.10–before 14.6.5, 14.7–before 14.7.4, and 14.8–before 14.8.2. An unauthorized user could disclose runner registration tokens via an information-disclosure vulnerability triggered by quick actions commands, enab...

CVE-2022-0427: Cross-Site Request Forgery (CSRF)

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover...

CVE-2021-39876: Incorrect Authorization

In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups...

CVE-2022-0371: Undefined Security Weakness

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails...

CVE-2022-0735: Undefined Security Weakness

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure...

CVE-2022-0488: Uncontrolled Resource Consumption

An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes...

CVE-2022-0549: Undefined Security Weakness

An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not...

CVE-2021-4191: Undefined Security Weakness

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API...

CVE-2022-0751: Undefined Security Weakness

Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands...

File upload vulnerability exists in InforSuite AS of Shandong Zhongchuang Software Commercial Middleware Co.

InforSuite AS is an enterprise-class middleware certified as fully compatible with Jakarta EE 9, 8 and Java EE8, 7, 6. Ltd. InforSuite AS has a file upload vulnerability, which can be exploited by attackers to gain control of the server...

InforSuite AS has a logic flaw vulnerability in Shandong Zhongchuang Software Commercial Middleware Co.

InforSuite AS is an enterprise-class middleware certified as fully compatible with Jakarta EE 9, 8 and Java EE8, 7, 6. Ltd. InforSuite AS has a logic flaw vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...