CVE-2024-6446

Removed by vendor...

CVE-2024-6446 Business Logic Errors in GitLab

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application...

CVE-2024-6446

CVE-2024-6446 affects GitLab versions 17.1 to 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. The issue allows a crafted URL to coerce a user into trusting an attacker-controlled application. The public sources describe the vulnerability and note a patch release: GitLab 17.3.2 (and related fi...

CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions...

CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions...

CVE-2024-6389

CVE-2024-6389 affects GitLab-CE/EE versions: 17.0 up to but not including 17.1.7, 17.1.x, 17.2 up to but not including 17.2.5, and 17.3 up to but not including 17.3.2. A guest user could access commit information via the release Atom endpoint, contrary to permissions, indicating a permissions/aut...

CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions...

CVE-2024-6389

Removed by vendor...

CVE-2024-8124 Inefficient Regular Expression Complexity in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-8124 Inefficient Regular Expression Complexity in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-8124 Inefficient Regular Expression Complexity in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-8124

Removed by vendor...

CVE-2024-8124

GitLab CE/EE is affected in multiple tracked branches: versions from 16.4 up to 17.1.7, from 17.2 up to 17.2.5, and from 17.3 up to 17.3.2 are vulnerable to Denial of Service via a specific POST request. The issue has CVSS v3.1 base score 7.5 (HIGH) with network attack vector, low complexity, and...

CVE-2024-8640 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server...

CVE-2024-8640

CVE-2024-8640 affects GitLab Enterprise Edition (GitLab EE) versions with all 16.11+, up to but not including 17.1.7; 17.2.x up to 17.2.5; and 17.3.x up to 17.3.2. Root cause is incomplete input filtering that enables command injection into a connected Cube server. Impact is high: confidentiality...

CVE-2024-8640 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server...

CVE-2024-8640 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server...

CVE-2024-8640

Removed by vendor...

Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution

GitLab on Wednesday released security updates to address 17 security vulnerabilities, including a critical flaw that allows an attacker to run pipeline jobs as an arbitrary user. The issue, tracked as CVE-2024-6678, carries a CVSS score of 9.9 out of a maximum of 10.0 "An issue was discovered in...

PT-2024-39145 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.6 through 17.1.7 GitLab EE versions 17.2 through 17.2.5 GitLab EE versions 17.3 through 17.3.2 Description: A privilege escalation issue has been discovered in GitLab EE. This issue allows a user assigned the Admin Group...