CVE-2022-4143

An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization...

Authorization

An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization...

PT-2023-9613 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.0 through 16.3 Description: The issue concerns the insufficient warning about security implications of granting merge rights to protected branches in GitLab EE/CE. This could potentially lead to exposure of sensitive...

PT-2023-13984 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.7 through 15.8.4 GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab that allows for crafted, unapproved merge requests to be introduced and merged...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from allowing the...

ffmpeg:ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer: Segv on unknown address in ff_evc_parse_nal_unit

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6240076603195392 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegBSFEVCFRAMEMERGEfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

PT-2023-5557

Name of the Vulnerable Software and Affected Versions Eclipse JGit versions prior to 6.6.1.202309021850-r Eclipse JGit versions prior to 6.7.0.202309050840-r Eclipse JGit versions 5.13.3 prior to 5.13.3.202401111512-r Description The issue is related to the handling of symbolic links in Eclipse...

com.cloudbees.jenkins.plugins:mansion-cloud (>=1.16, <=1.28), com.cloudbees.jenkins.plugins:oki-docki (1.0) +64 more potentially affected by CVE-2023-35141 via org.jenkins-ci.main:jenkins-core (1.532)

org.jenkins-ci.main:jenkins-core MAVEN version 1.532 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:mansion-cloud =1.16, =1.10, =1.4.0, =1.20, =1.532, =1.35, =1.45 -...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2023-35141 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.switchfly:gitlab-merge-request-jenkins (1.2.2), org.jenkins-ci.main:jenkins-test-harness (1.563) +2 more potentially affected by CVE-2023-35141 via org.jenkins-ci.main:jenkins-core (1.563)

org.jenkins-ci.main:jenkins-core MAVEN version 1.563 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 1.2.2 - org.jenkins-ci.main:jenkins-test-harness 1.5...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

Cross site scripting

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

PT-2023-19580 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: An issue has been discovered in GitLab CE/EE where a specially crafted merge request could lead to a stored XSS on the client side. This allows...

CVE-2023-2442

Removed by vendor...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-2442: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...