CVE-2022-2456

The CVE-2022-2456 entry describes a vulnerability in GitLab CE/EE affecting all versions before 15.0.5, and certain updates before 15.1.4 and 15.2.1. The issue allows malicious group or project maintainers to change the visibility of their group or project by crafting a malicious POST request. Th...

CVE-2022-2417

Removed by vendor...

CVE-2022-2417

GitLab CVE-2022-2417 affects GitLab CE/EE; root cause is insufficient validation during project import, enabling an authenticated user to import a project with branch names that are 40 hexadecimal characters, which could enable supply-chain attacks by pinning to a specific commit. Affected versio...

CVE-2022-2417

Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply...

CVE-2022-2539

CVE-2022-2539 affects GitLab CE/EE. Versions affected are 14.6+ up to 15.0.5, 15.1 up to 15.1.4, and 15.2 up to 15.2.1. The issue enables a project member to filter issues by contact and organization, indicating an improper access/permission condition within GitLab’s issue filtering feature. The ...

CVE-2022-2539

Removed by vendor...

CVE-2022-2539

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization...

CVE-2022-2539

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization...

CVE-2022-2512

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project member...

CVE-2022-2512

CVE-2022-2512 affects GitLab CE/EE: 15.0 up to before 15.0.5, 15.1 up to before 15.1.4, and 15.2 up to before 15.2.1. The issue is that membership changes are not reflected in TODOs for confidential notes, allowing former project members to read updates via TODOs. Impact is described as high conf...

CVE-2022-2512

Removed by vendor...

CVE-2022-2499

GitLab EE Jira integration contains an insecure direct object reference vulnerability that may allow an attacker to leak Jira issues. Affected GitLab EE versions: 13.10–15.0.4, 15.1–15.1.3, and 15.2–15.2.0. Root cause is an insecure direct object reference in the Jira integration. Remediation by ...

CVE-2022-2497

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL...

CVE-2022-2497

GitLab CVE-2022-2497 affects GitLab CE/EE with multiple version ranges: 12.6–15.0.4, 15.1.x before 15.1.4, and 15.2.x before 15.2.1. The issue lets a malicious developer exfiltrate an integration’s access token by modifying an integration URL so authenticated requests hit an attacker-controlled s...

CVE-2022-2497

Removed by vendor...

CVE-2022-2531

An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing...

CVE-2022-2531

CVE-2022-2531 affects GitLab EE, with vulnerable versions including 12.5–15.0.4, 15.1–15.1.3, and 15.2–15.2.0. The root cause is incorrect authentication on the Grafana API under specific conditions, allowing unauthenticated users to perform queries through a path traversal vulnerability. The doc...

PT-2022-15796 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.0.5 GitLab CE/EE versions 15.1 prior to 15.1.4 GitLab CE/EE versions 15.2 prior to 15.2.1 Description: An issue has been discovered that may allow group members to bypass 2FA enforcement enabled at the group...

CVE-2022-1561

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, bu...

CVE-2022-1561 Crafted backend URLs in Lura Project

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, bu...