PT-2025-37290

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 18.1.5 GitLab CE/EE versions 18.2 through 18.2.5 GitLab CE/EE versions 18.3 through 18.3.1 Description: An issue exists in GitLab CE/EE that could allow an authenticated user to disrupt background job...

CVE-2025-0290

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive...

CVE-2023-32750

Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which are run in the background. The job "remote-download" can be used to cause the backend to send a HTTP GET request to a specified URL and save the response to a new file. The...

BIT-GITLAB-2025-0290 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive...

CVE-2025-0290

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive...

UBUNTU-CVE-2025-0290

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive...

CVE-2025-0290

CVE-2025-0290 affects GitLab CE/EE since 15.0 up to but not including 17.5.5, from 17.6 up to 17.6.3, and from 17.7 up to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive. The connected sources indicate fixed versions: upgrad...

GitLab Community Edition和GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Community Edition and GitLab Enterprise...

PT-2025-3813 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 17.5.5 GitLab CE/EE versions 17.6 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.1 Description: An issue has been discovered in GitLab CE/EE where under certain conditions, processing of CI artifacts...

CVE-2024-52521 Nextcloud Server has a potential hash collision for background jobs could skip queuing them

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 t...

Potential hash collision for background jobs could skip queuing them

None...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud has a security vulnerability that stems from an MD5 hash being used to check the uniqueness of background jobs. This increases the likelihood tha...

CVE-2023-50727

CVE-2023-50727 concerns a reflected XSS vulnerability in the Resque (Ruby) web interface. The issue arises when the /queues endpoint is appended with a crafted string (for example, current_queue path manipulation like ">). Affected software is Resque prior to version 2.6.0; the vulnerability i...

CVE-2023-50727 Resque vulnerable to reflected XSS in Queue Endpoint

Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...

CVE-2023-50725 Resque vulnerable to reflected XSS in resque-web failed and queues lists

Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...

CVE-2023-50725 Resque vulnerable to reflected XSS in resque-web failed and queues lists

Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...

CVE-2023-50725

CVE-2023-50725 affects the Resque library’s web UI (resque-web) where two paths, “/failed/?class=” and “/queues/>”, allow reflected XSS. The root cause is improper input validation on those endpoints. Impact stated across sources: remote authenticated attacker could lure a user to click a craf...

Resque Cross-Site Scripting Vulnerability

Resque is a Redis-powered library open-sourced by Resque for creating background jobs, placing them on multiple queues and processing them later. A cross-site scripting vulnerability exists in versions of Resque prior to 2.6.0, which stems from vulnerability to reflective cross-site scripting XSS...

Design/Logic Flaw

Resque pronounced like "rescue" is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the currentqueue parameter in the path of the queues endpoin...

CVE-2023-50724

Summary: CVE-2023-50724 affects the Resque project, specifically the resque-web component prior to version 2.1.0, which is vulnerable to reflected XSS via the current_queue parameter in the queues endpoint path. The issue has been patched in 2.1.0. What’s affected: Resque and its resque-web inter...