Improper access control

An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users...

CVE-2022-3325

Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user...

CVE-2022-2884

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

PT-2022-21546 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.2.5 GitLab CE/EE versions 15.3 prior to 15.3.4 GitLab CE/EE versions 15.4 prior to 15.4.1 Description: A branch/tag name confusion issue allows an attacker to manipulate pages where the content of the default...

PT-2022-20196 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to the fixed version Description: The issue is related to improper control of a resource identifier in Error Tracking, allowing an authenticated attacker to generate content that could cause a victim to make...

CVE-2022-3067

CVE-2022-3067 affects GitLab CE/EE via the Import functionality, allowing an authenticated user to read arbitrary project contents. The flaw exists in versions: 14.4 up to 15.2.4, 15.3 up to 15.3.3, and 15.4 up to 15.4.0. The underlying cause, as described in the sources, is not fully disclosed h...

CVE-2022-2592

A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive loa...

CVE-2022-3283

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used ...

CVE-2022-2428

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

CVE-2022-3279

CVE-2022-3279 : In GitLab CE/EE, an unhandled exception in job log parsing affects all versions prior to 15.2.5, 15.3 before 15.3.4, and 15.4 before 15.4.1, allowing an attacker to prevent access to job logs. The description does not provide a confirmed remediation or patch details. No connected ...

CVE-2022-3060

CVE-2022-3060 concerns GitLab CE/EE with an improper control of a resource identifier in Error Tracking. Affected products include GitLab CE/EE versions from 12.7 onward. The root issue allows an authenticated attacker to generate content that could cause a victim to make unintended arbitrary req...

CVE-2022-2592

The CVE-2022-2592 issue concerns GitLab CE/EE where a lack of length validation in Snippet descriptions allows an authenticated attacker to create excessively long Snippets that, when requested with or without authentication, can load the server and cause a Denial of Service. Documents consistent...

CVE-2022-3279

An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs...

CVE-2022-2931

CVE-2022-2931 affects GitLab CE/EE. A vulnerability in the handling of malformed content in issue descriptions could trigger high CPU usage, enabling a potential DoS. Affected versions include all before 15.1.6, all 15.2 up to before 15.2.4, and all 15.3 up to before 15.3.2. The provided document...

CVE-2022-3030

An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users...

CVE-2022-2884

A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint...

CVE-2022-2527

An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...

PT-2022-20060 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.1.6 GitLab CE/EE versions 15.2 through 15.2.3 GitLab CE/EE versions 15.3 through 15.3.1 Description: An issue has been discovered in GitLab CE/EE that may allow an attacker to guess a user's password by brute...

CVE-2022-2931

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage...

CVE-2022-3283

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used ...