CVE-2023-2001

CVE-2023-2001 affects GitLab CE/EE across versions: all before 15.10.8, all 15.11 before 15.11.7, and 16.0 before 16.0.2. The issue allows an attacker to spoof protected tags, potentially causing a victim to download malicious code. The description does not specify affected platforms beyond GitLa...

CVE-2023-2485

CVE-2023-2485 (GitLab CE/EE) affects GitLab versions 14.1–15.10.7, 15.11–15.11.6, and 16.0–16.0.1. A malicious maintainer can escalate other project members to Owners when importing members from a project where those users are Owners. Root cause and impact are consistently described across source...

CVE-2023-2442

GitLab CE/EE versions affected: 15.11 up to 15.11.6 (15.11.x) and 16.0 up to 16.0.1. The issue is a stored XSS vulnerability triggered by a specially crafted merge request, enabling an attacker to perform arbitrary actions on behalf of victims in the client. Mitigation: upgrade to GitLab 15.11.7 ...

CVE-2023-2199

Removed by vendor...

CVE-2023-2198

Removed by vendor...

CVE-2023-2015

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform...

CVE-2023-2001

An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code...

CVE-2023-2199

GitLab CE/EE (versions 12.0–15.10.7, 15.11.0–15.11.6, 16.0.0–16.0.1) are affected by CVE-2023-2199 due to a Regular Expression Denial of Service in the preview_markdown endpoint. The underlying issue is a regex-based processing path that can be triggered by crafted payloads, potentially impacting...

CVE-2023-2199

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the...

CVE-2023-2198

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the...

CVE-2023-2015

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform...

CVE-2023-0508

Removed by vendor...

CVE-2023-2132

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted...

CVE-2023-2132

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted...

Code injection

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted...

CVE-2023-0921

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage...

Input validation

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage...

PT-2023-18096 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.4 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: An issue has been discovered in GitLab CE/EE, where a DollarMathPostFilter Regular Expression Denial...

CVE-2023-2132

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted...

CVE-2023-2132

GitLab CE/EE versions affected by CVE-2023-2132 include 15.4–15.10.7, 15.11.0–15.11.6, and 16.0.0–16.0.1. The vulnerability arises from a DollarMathPostFilter Regular Expression Denial of Service in the preview_markdown endpoint, allowing crafted payloads to cause resource exhaustion. Affected co...