CVE-2023-29975

An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification...

CVE-2023-29975

An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification...

CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

Design/Logic Flaw

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

Netgate pfSense CE Security Vulnerability

Netgate pfSense CE is a free and open source FreeBSD-based firewall and router software. A security vulnerability exists in Netgate pfSense CE version 2.6.0, which originated from a vulnerability that allows an attacker to compromise a user account via a weak password request...

CVE-2023-29974

CVE-2023-29974 affects pfSense CE 2.6.0. The linked documents describe a weakness in password requirements that can allow an attacker to compromise user accounts. The core issue is a weak password policy in the affected release; no technical details on the exact root cause, affected components, o...

CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

Input validation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

Removed by vendor...

CVE-2023-3909 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

GitLab CE/EE is affected by CVE-2023-3909: A Regular Expression Denial of Service can be triggered by a very large string in timeout input within gitlab-ci.yml. Affected versions are: all 12.3–16.3.5, all 16.4.x before 16.4.2, and all 16.5.x before 16.5.1. Root cause stated is inefficient regex h...

CVE-2023-3246

CVE-2023-3246 affects GitLab EE/CE across multiple branches: all versions before 16.3.6, all versions from 16.4 before 16.4.2, and all versions from 16.5 before 16.5.1, with the impact described as the ability for an attacker to block the Sidekiq job processor. The connected documents reiterate t...

Default configuration

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to...

CVE-2023-5825

GitLab CE/EE CVE-2023-5825 affects 16.2–16.3.5, 16.4.0–16.4.1, and 16.5.0 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path, causing memory exhaustion via an infinite loop and Denial of Service. Impact: availability only. Remediation: upgrade to GitLab 16.3...

CVE-2023-5831

GitLab CE/EE vulnerable when the super_sidebar_logged_out feature flag is enabled. Affected versions are: 16.0–16.3.5, 16.4.x prior to 16.4.2, and 16.5.x prior to 16.5.1. In these cases, with the flag enabled, there is a risk of unintentionally disclosing GitLab version metadata to unauthorized a...

CVE-2023-5831 Insertion of Sensitive Information Into Sent Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...