CVE-2022-1105

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled...

CVE-2022-1099

Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab...

CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts...

UBUNTU-CVE-2022-1099

Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab...

UBUNTU-CVE-2022-1185

A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file...

PT-2022-13660 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.1 through 14.7.7 GitLab CE/EE versions 14.8.0 through 14.8.5 GitLab CE/EE versions 14.9.0 through 14.9.2 Description: A potential DOS issue was discovered in GitLab CE/EE. The API to update an asset as a link from a...

PT-2022-13402 · Gitlab +1 · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.8.0 through 14.7.7 GitLab CE/EE versions 14.8.0 through 14.8.4 GitLab CE/EE versions 14.9.0 through 14.9.1 Description: The issue is related to incorrect authorization in the Asana integration's branch restriction...

PT-2022-13659 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.7.7 GitLab CE/EE versions 14.8 prior to 14.8.5 GitLab CE/EE versions 14.9 prior to 14.9.2 Description: The issue allows an attacker to impact the performance of GitLab by adding a very large number of tags to...

PT-2022-13703 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.2 through 14.7.7 GitLab CE/EE versions 14.8 through 14.8.5 GitLab CE/EE versions 14.9 through 14.9.2 Description: An issue in GitLab CE/EE allows an unauthorized user to read the approval rules of a private project...

PT-2022-13670 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.7.7 GitLab CE/EE versions 14.8 prior to 14.8.5 GitLab CE/EE versions 14.9 prior to 14.9.2 Description: The issue concerns missing filtering in an error message, which exposes sensitive information when an...

PT-2022-13702 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.1 through 14.7.7 GitLab CE/EE versions 14.8 through 14.8.5 GitLab CE/EE versions 14.9 through 14.9.2 Description: A blind SSRF attack was possible through the repository mirroring feature. Recommendations: For version...

PT-2022-13665 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.9 prior to 14.9.2 GitLab CE/EE versions 14.8 prior to 14.8.5 GitLab CE/EE versions 14.0 prior to 14.7.7 Description: A business logic error in Project Import under certain conditions caused imported projects to show a...

UBUNTU-CVE-2022-0489

An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments...

UBUNTU-CVE-2022-0390

Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard...

UBUNTU-CVE-2022-0373

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address...

GitLab Community Edition and GitLab Enterprise Edition have vulnerabilities in input validation.

GitLab Enterprise Edition is a content management system.GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An input validation error vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE due to insufficient validation of user-supplied input in the...

GitLab Enterprise Edition and GitLab Community Edition code-related vulnerabilities

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A code issue exists in GitLab Enterprise Edition and GitLab Community Edition that stems from insufficient validation of user-supplied input in the repository...

GitLab Enterprise Edition and GitLab Community Edition have vulnerabilities related to information leakage

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An information disclosure vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition, which stems from the application outputting too much...

GitLab Community Edition and GitLab Enterprise Edition have resource management vulnerabilities

GitLab Enterprise Edition is a content management system.GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An input validation error vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE, which exists because there is no limit to the number of tag...

GitLab Community Edition and GitLab Enterprise Edition have resource management vulnerabilities

GitLab Enterprise Edition is a content management system GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A resource management error vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE due to insufficient validation of user-supplied input in...