2668 matches found
CVE-2021-39932
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing co...
CVE-2021-39932
GitLab CE/EE is affected by CVE-2021-39932: all versions from 11.0 up to 14.3.6, all 14.4.x before 14.4.4, and all 14.5.x before 14.5.2 are vulnerable. The issue arises when using large payloads in the diff feature, which can trigger high load times for users reviewing code changes. The provided ...
CVE-2021-39932
Removed by vendor...
CVE-2021-39934
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2...
CVE-2021-39934
Removed by vendor...
CVE-2021-39919
CVE-2021-39919 affects GitLab CE/EE: vulnerable in all versions before 14.3.6, all versions from 14.4 before 14.4.4, and all versions from 14.5 before 14.5.2. The reset password token and new user email token are logged, risking information disclosure. Remediation is to upgrade to fixed releases ...
CVE-2021-39919
Removed by vendor...
CVE-2021-39915
CVE-2021-39915: GitLab CE/EE GraphQL API has improper access control that lets an attacker view the names of project access tokens on arbitrary projects. Affected: GitLab versions starting from 13.0 up to before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2. Remediation per sources is to upg...
CVE-2021-39933
CVE-2021-39933 affects GitLab CE/EE: all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. An input handling regex (notes, comments, etc) is vulnerable to catastrophic backtracking, enabling a denial of se...
CVE-2021-39933
Removed by vendor...
CVE-2021-39938
Removed by vendor...
CVE-2021-39938
CVE-2021-39938 : A vulnerable regular expression in GitLab CE/EE allows DoS via specially crafted deploy slash commands. Affected versions: GitLab CE/EE 8.15 before 14.3.6; starting from 14.4 before 14.4.4; starting from 14.5 before 14.5.2. Remediation available by upgrading to patched releases (...
CVE-2021-39936
CVE-2021-39936 affects GitLab CE/EE: improper access control allows an attacker with a deploy token to access a project’s disabled wiki. Affected versions include 10.7–14.3.6, 14.4–14.4.3, and 14.5–14.5.1. The issue is caused by insufficient access checks on wiki access via deploy tokens. Public ...
CVE-2021-39931
GitLab CE/EE CVE-2021-39931 affects all versions from 8.11 up to 14.3.6, and 14.4 up to 14.4.4, and 14.5 up to 14.5.2. The flaw is a business-logic error that allowed an unauthorized project member to delete a protected branch. Impact described in the sources involves unauthorized deletion by low...
CVE-2021-39945
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project...
CVE-2021-39945
CVE-2021-39945 affects GitLab CE/EE API. A bug in access control allows an author of a Merge Request to approve the MR even after their project access is revoked, across GitLab versions: 9.4–14.3.6, 14.4–14.4.3, and 14.5–14.5.1. Root cause is improper access restriction in the Merge Request appro...
CVE-2021-39944
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege ...
CVE-2021-39944
CVE-2021-39944 affects GitLab CE/EE: multiple branches of affected versions, specifically 11.0–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1. The root cause is a permissions validation flaw that lets group members with a developer role elevate to maintainer on imported projects. Practical impact: priv...
CVE-2021-39940
CVE-2021-39940 affects GitLab CE/EE and specifically the GitLab Maven Package registry. Versions 13.2–13.? (starting 13.2) up to but not including 14.3.6, 14.4 up to but not including 14.4.4, and 14.5 up to but not including 14.5.2 are vulnerable. The issue is a regular expression denial of servi...