1389 matches found
Authorization
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups...
CVE-2021-22259
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API...
Design/Logic Flaw
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API...
CVE-2021-22259
CVE-2021-22259 describes a potential denial-of-service against GitLab EE beginning with version 12.6, caused by lack of pagination in the dependencies API. The issue affects GitLab EE (starting at 12.6) and has CVSS-derived scores indicating higher impact on availability (as per the provided metr...
CVE-2021-39899
In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...
CVE-2021-39885
Removed by vendor...
CVE-2021-39883: Undefined Security Weakness
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups...
CVE-2021-39885: Improper Neutralization of Input During Web Page Generation
A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious...
CVE-2021-22259: Undefined Security Weakness
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API...
CVE-2021-22244
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data...
Authorization
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data...
CVE-2021-22244
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data...
CVE-2021-22244
Removed by vendor...
CVE-2021-22244
CVE-2021-22244 concerns an improper authorization flaw in GitLab EE’s vulnerability report feature, allowing a reporter to access vulnerability data. Affected: GitLab Enterprise Edition, versions since 13.1. Root cause: improper authorization. Impact: leakage of vulnerability data to reporters; n...
CVE-2021-22247
The CVE concerns GitLab CE/EE (all versions since 13.0) with improper authorization that allows guests in private projects to view CI/CD analytics. Multiple connected sources (e.g., Red Hat CVE page, OSV, NVD, and OSV Ubuntu/NASL references) corroborate the issue. The root cause details beyond “i...
CVE-2021-22244: Undefined Security Weakness
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data...
CVE-2021-22253
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...
CVE-2021-22249
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group...
Input validation
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings...