2677 matches found
CVE-2024-1451
GitLab CE/EE contains a stored XSS vulnerability (CVE-2024-1451) affecting all versions from 16.9 up to 16.9.0. A crafted payload on the user profile page could execute arbitrary actions in victims’ browsers. Root cause: improper input handling leading to stored XSS. Impact is client-side comprom...
CVE-2024-1525
GitLab CE/EE contains CVE-2024-1525: an authentication bypass where, under certain conditions, an LDAP user can reset their password via their verified secondary email and sign in with reset credentials, bypassing LDAP. Affected versions are GitLab 16.1–16.7.6, 16.8 (except 16.8.3 and later), and...
CVE-2024-1525
Removed by vendor...
CVE-2024-25415
A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...
Remote code execution
A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...
CVE-2024-25415
A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...
CVE-2024-25415
A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...
CE Phoenix Cart Security Vulnerability
CE Phoenix Cart is a free, open source e-commerce shopping cart software from CE Phoenix Cart Open Source. A security vulnerability exists in CE Phoenix Cart v1.0.8.20, which originates from a Remote Code Execution RCE vulnerability in component /admin/definelanguage.php...
CVE-2024-25415
CVE-2024-25415 is an RCE affecting CE Phoenix v1.0.8.20 via /admin/define_language.php, enabling arbitrary PHP code execution by injecting a crafted payload into english.php. Multiple sources confirm the issue and link to public PoCs/exploits, with CVSS v3.1 scores: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:...
CVE-2023-6159
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...
Input validation
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...
CVE-2023-6159 Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...
CVE-2023-6159
CVE-2023-6159 affects GitLab CE/EE versions 12.7–16.6.5, 16.7.0–16.7.3, and 16.8.0–16.8.0; it enables a Regular Expression Denial of Service when processing a crafted Cargo.toml. The root cause is an inefficient regex handling in input processing. GitLab has released patched versions (e.g., 16.8....
CVE-2023-6159
Removed by vendor...
Input validation
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...
CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...
CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...
CVE-2023-5933
CVE-2023-5933 affects GitLab CE/EE. The issue is in the handling of user name input, where improper input sanitization enables arbitrary API PUT requests. Affected versions are all releases after 13.7 and before 16.6.6, versions 16.7 before 16.7.4, and versions 16.8 before 16.8.1. The reference d...
CVE-2024-0402
CVE-2024-0402: A path traversal flaw in GitLab CE/EE allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. Affected versions are 16.0–16.0.x up to 16.6.5, 16.7.x up to 16.7.3, and 16.8.x up to 16.8.0. Exploitation details are not provi...