22523 matches found
CVE-2024-9870
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...
CVE-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...
CVE-2024-9870
CVE-2024-9870 is an external service interaction vulnerability in GitLab Enterprise Edition (GitLab EE) affecting all versions from 15.11 up to 17.6.5, 17.7 up to 17.7.4, and 17.8 up to 17.8.2. The issue allows an attacker to cause the GitLab server to issue requests to unintended external servic...
CVE-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...
CVE-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...
CVE-2024-9870
Removed by vendor...
CVE-2025-0516 Incorrect Authorization in GitLab
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data...
CVE-2025-0516
Removed by vendor...
CVE-2025-0516 Incorrect Authorization in GitLab
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data...
CVE-2025-0516 Incorrect Authorization in GitLab
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data...
CVE-2025-0516
CVE-2025-0516 affects GitLab CE/EE. The vulnerability is caused by improper authorization that allows users with limited permissions to perform unauthorized actions on critical project data. Affected versions are GitLab: 17.7 before 17.7.4 and 17.8 before 17.8.2; these are vulnerable, per the pro...
CVE-2025-1212 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ee-fips, gitlab-pages, gitlab-ee-fips, gitlab-pages-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ee, gitlab-cng-fips, gitlab-ee...
CVE-2025-1212 vulnerabilities
Vulnerabilities for packages: gitlab-pages, gitlab-cng...
CVE-2025-1212
An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information...
CVE-2025-1042 vulnerabilities
Vulnerabilities for packages: gitlab-pages, gitlab-cng...
CVE-2025-1042 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ee-fips, gitlab-pages, gitlab-ee-fips, gitlab-pages-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ee, gitlab-cng-fips, gitlab-ee...
CVE-2025-1042
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way...
CVE-2025-0376 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ee-fips, gitlab-pages, gitlab-ee-fips, gitlab-pages-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ee, gitlab-cng-fips, gitlab-ee...
CVE-2025-0376
An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page...