UBUNTU-CVE-2024-2191

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only...

CVE-2024-5430

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL...

GitLab 16.9 < 16.11.5 / 17.0 < 17.0.3 / 17.1 < 17.1.1 (CVE-2024-2191)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge reque...

CVE-2024-2191

Removed by vendor...

CVE-2024-2191

CVE-2024-2191 (GitLab CE/EE) affects GitLab versions with an improper access control: the merge request title can be publicly visible when the project members setting is used. Affected ranges are: 16.9 up to but not including 16.11.5, 17.0 up to but not including 17.0.3, and 17.1 up to but not in...

CVE-2024-5430 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL...

CVE-2024-5430

CVE-2024-5430 affects GitLab CE/EE. Affected are all versions from 16.10 up to but not including 16.11.5, from 17.0 up to but not including 17.0.3, and from 17.1 up to but not including 17.1.1. The underlying issue allows a project maintainer to delete the merge request approval policy via GraphQ...

CVE-2024-5430

Removed by vendor...

CVE-2024-5430 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL...

GitLab Access Control Error Vulnerability

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An access control error vulnerability exists in GitLab CE/EE, which stems from...

GitLab Access Control Error Vulnerability

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. An access control error vulnerability exists in GitLab CE/EE versions 16.10...

GitLab 13.7 < 13.7.6 / 13.8 < 13.8.2 (CVE-2021-22182)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. CVE-2021-22182 Note that Nessus has not tested for this issue...

GitLab Enterprise Edition 跨站请求伪造漏洞

GitLab Enterprise Edition EE is a content management system from GitLab Corporation. A cross-site request forgery vulnerability exists in GitLab Enterprise Edition, which allows an attacker to force a user with an active SAML session to approve MR via CSRF.The affected versions are as follows: 16...

PT-2024-31862 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.7 through 16.9.6 GitLab EE versions 16.10 through 16.10.4 GitLab EE versions 16.11 through 16.11.1 Description: An issue has been discovered in GitLab EE, where an attacker could force a user with an active SAML session ...

BIT-GITLAB-2020-10078

GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability...

BIT-GITLAB-2020-10976

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

BIT-GITLAB-2021-22196

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name...

BIT-GITLAB-2021-22197

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other...

BIT-GITLAB-2021-22217

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request...

BIT-GITLAB-2021-39885

A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious...