4156 matches found
CVE-2022-3514
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...
CVE-2022-4342
CVE-2022-4342 affects GitLab CE/EE versions: 15.1–15.5.6 (up to 15.5.7 noted by some sources), 15.6.x prior to 15.6.4, and 15.7.x prior to 15.7.2. The issue allows a malicious Maintainer to leak masked webhook secrets by changing the webhook target URL. Public sources corroborate the basic descri...
CVE-2022-3613
Removed by vendor...
CVE-2023-0042
Removed by vendor...
CVE-2022-4365
Removed by vendor...
CVE-2022-3573
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...
CVE-2022-3573: Improper Neutralization of Input During Web Page Generation
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...
CVE-2022-4342
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook...
CVE-2022-4342: Undefined Security Weakness
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook...
CVE-2022-4037
GitLab CE/EE is affected by CVE-2022-4037 across all versions before 15.5.7, all 15.6.x before 15.6.4, and all 15.7.x before 15.7.2. The issue is a race condition that can allow verified email forgery and takeover of third‑party accounts when GitLab is used as an OAuth provider. Remediation per t...
CVE-2022-4365
GitLab CE/EE is affected by CVE-2022-4365 and CVE-2023-4378: a malicious Maintainer can leak the Sentry token by changing the URL in the Sentry error tracking settings. Affected are GitLab versions starting from 11.8 up to 15.5.7, 15.6 up to 15.6.4, and 15.7 up to 15.7.2. The issue stems from an ...
CVE-2022-4131
GitLab CE/EE is affected by CVE-2022-4131 due to a regex parsing issue in user agents. Affected versions are: 10.8 up to 15.5.7, 15.6 up to 15.6.4, and 15.7 up to 15.7.2. The issue can cause a Denial of Service on a GitLab instance. Root cause: regex handling in user agent parsing. Remediation pe...
CVE-2022-3573
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...
CVE-2022-3613
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service...
CVE-2022-3870: Exposure of Sensitive Information to an Unauthorized Actor
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private...
CVE-2022-3613: Uncontrolled Resource Consumption
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service...
CVE-2023-0042
The CVE-2023-0042 issue affects GitLab CE/EE versions 11.4 through 15.5.7, 15.6 through 15.6.4, and 15.7 through 15.7.2. The vulnerability stems from GitLab Pages allowing redirection to arbitrary protocols, enabling potential abuse of page redirects. Patches are available: upgrade to 15.5.7 or l...
CVE-2022-3613
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service...
CVE-2023-0042
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols...