26822 matches found
CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions...
CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions...
CVE-2025-12697
GitLab CE/EE was affected by CVE-2025-12697. The issue could allow an authenticated user with maintainer permissions to reveal Datadog API credentials under certain conditions. Remediation has been applied in GitLab releases: 18.7.6 (for 15.5–18.7.x), 18.8.6, and 18.9.2, which address the vulnera...
CVE-2025-12697
Removed by vendor...
CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions...
CVE-2025-12704
CVE-2025-12704 affects GitLab EE prior to 18.7.6, 18.8.x prior to 18.8.6, and 18.9.x prior to 18.9.2, where an authenticated user could access Virtual Registry data in groups they are not members due to improper authorization. The NVD/NCSC entries confirm the remediation via patch releases: GitLa...
CVE-2025-12704 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain...
CVE-2025-12704 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain...
CVE-2025-12704 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain...
CVE-2025-13690
GitLab CE/EE versions with affected ranges are vulnerable to a DoS due to improper input validation on webhook header names when the user is authenticated. Specifically, all 16.11.x prior to 18.7.6, all 18.8.x prior to 18.8.6, and all 18.9.x prior to 18.9.2 are impacted. The issue is mitigated by...
CVE-2025-13690 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under...
CVE-2025-13690 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under...
CVE-2025-13690
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under...
CVE-2025-13690 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under...
CVE-2025-13690
Removed by vendor...
CVE-2025-13929 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certai...
CVE-2025-13929 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certai...
CVE-2025-13929
GitLab CVE-2025-13929 affects GitLab CE/EE; unauthenticated users could trigger a denial of service by sending crafted requests to repository archive endpoints in affected versions: 10.0–18.7.5, 18.8.0–18.8.5, and 18.9.0–18.9.1. CVSS v3.1 base score 7.5 (HIGH) with network access, no privileges, ...
CVE-2025-13929 Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certai...