CVE-2022-0136

CVE-2022-0136 affects GitLab, with a blind SSRF vulnerability via the Project Import feature. Affected releases: GitLab 10.5–14.5.4, 14.6–14.6.4, and 14.7–14.7.1. Root cause: input handling in Project Import allowed server-side requests to internal resources. Impact: potential for arbitrary inter...

CVE-2022-0136

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature...

PT-2022-12987 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.5 to 14.5.4 GitLab versions 14.6 to 14.6.4 GitLab versions 14.7 to 14.7.1 Description: A vulnerability was discovered in GitLab, making it susceptible to a blind Server-Side Request Forgery SSRF attack. This issue is...

GitLab Enterprise Edition 和 Gitlab Community Edition 代码问题漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A code issue vulnerability exists in GitLab Enterprise Edition and Gitlab Community Edition that stems from the software not adequately validating user-supplie...

CVE-2022-0154

An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their...

Cross site request forgery (csrf)

An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their...

CVE-2022-0154

GitLab CSRF vulnerability CVE-2022-0154 affects all GitLab versions 7.7–14.4.5, 14.5.0–14.5.3, and 14.6.0–14.6.2. The issue allows a malicious user to import their GitHub project into another GitLab account via a Cross-Site Request Forgery attack. No patch details are provided in the supplied doc...

CVE-2021-39944

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege ...

CVE-2021-39895

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

Code injection

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

UBUNTU-CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses...

CVE-2021-22258

Removed by vendor...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

GitLab 信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

PT-2021-11123 · Siemens · Logo! Soft Comfort

Name of the Vulnerable Software and Affected Versions: LOGO! Soft Comfort versions prior to V8.4 Description: A zip slip vulnerability could be triggered while importing a compromised project file to the affected software. This issue could ultimately lead to a system takeover by an attacker if...

FreeBSD : Gitlab -- Multiple vulnerabilities (56abf87b-96ad-11eb-a218-001b217b3468)

Gitlab reports : Arbitrary File Read During Project Import Kroki Arbitrary File Read/Write Stored Cross-Site-Scripting in merge requests Access data of an internal project through a public project fork as an anonymous user Incident metric images can be deleted by any user Infinite Loop When a Use...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Arbitrary File Read During Project Import Kroki Arbitrary File Read/Write Stored Cross-Site-Scripting in merge requests Access data of an internal project through a public project fork as an anonymous user Incident metric images can be deleted by any user Infinite Loop When a User...