CVE-2022-1121

A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption...

CVE-2022-1185

A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file...

CVE-2022-1185

CVE-2022-1185 describes a denial-of-service in GitLab CE/EE when rendering RDoc files. Affected versions: GitLab Community Edition/Enterprise Edition 10.x; 14.7.7 and earlier in the 14.7 line; 14.8.0 to 14.8.5; and 14.9.0 to 14.9.2. The vulnerability allows an attacker to crash the GitLab web app...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

CVE-2022-1120 affects GitLab CE/EE; missing filtering in an error message allows exposure of sensitive information when an include directive in CI/CD configuration fails. Affected versions: all before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. The available connected documents reiterate ...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1174

GitLab CE/EE is affected by CVE-2022-1174: a DoS condition where a crafted input in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc. can trigger high CPU usage. Affected versions: 13.7 before 14.7.7; 14.8 before 14.8.5; 14.9 before 14.9.2. Remediation: upgrade to fixed releases (14....

CVE-2022-1174

A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests,...

CVE-2022-1174

Removed by vendor...

CVE-2022-1188

CVE-2022-1188 affects GitLab CE/EE versions 12.1–before 14.7.7, 14.8.x before 14.8.5, and 14.9.x before 14.9.2, enabling a blind SSRF via the repository mirroring feature. The description notes a blind SSRF attack as the root cause, but the connected documents do not provide concrete technical de...

CVE-2022-1105

Summary of CVE-2022-1105 (GitLab) : An improper access control vulnerability affects GitLab CE/EE, allowing an unauthorized user to access pipeline analytics even when public pipelines are disabled. Affected versions are 13.11 through before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. The...

CVE-2022-1099

The CVE-2022-1099 entry affects GitLab CE/EE (GitLab CI runners) where adding an extremely large number of tags to a runner can degrade GitLab performance. Affected versions include all prior to 14.7.7, 14.8.x prior to 14.8.5, and 14.9.x prior to 14.9.2. The vulnerability stems from how runner ta...

CVE-2022-1099

Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab...

CVE-2022-1099

Removed by vendor...

CVE-2022-1100

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user...

CVE-2022-1189

CVE-2022-1189 affects GitLab CE/EE; all versions from 12.2 up to 14.7.7, 14.8.x up to 14.8.5, and 14.9.x up to 14.9.2 allow an unauthorised user to read the approval rules of a private project. Root cause: information disclosure due to improper access to approval rules. Impact: unauthorized visib...

CVE-2022-1189

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project...

CVE-2022-1189

Removed by vendor...

CVE-2022-0740

Removed by vendor...

CVE-2022-0740

GitLab CE/EE versions are affected by an incorrect authorization in the Asana integration's branch restriction feature, allowing closure of Asana tasks from unrestricted branches. Affected ranges: 7.8.0–14.7.6; 14.8.0–14.8.4; 14.9.0–14.9.1. Root cause: enforcement gap in the branch restriction lo...