CVE-2021-22250: Undefined Security Weakness

Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account...

CVE-2021-22256: Incorrect Authorization

Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22252

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

Type confusion

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22248

CVE-2021-22248 affects GitLab CE/EE (all versions since 13.12). The vulnerability is an improper authorization on the pipelines page, allowing unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only. The issue is described ...

CVE-2021-22248: Undefined Security Weakness

Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only...

CVE-2021-22252: Undefined Security Weakness

A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

CVE-2021-22254

Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9...

CVE-2021-22254

GitLab CVE-2021-22254 affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7, and 13.12.9. Under very specific conditions, a user could be impersonated via GitLab shell. The connected documents provide the same vulnerability description and affected version ranges but do not specify a root ca...

CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

CVE-2021-22234

CVE-2021-22234 affects GitLab CE/EE: all versions from 13.11 up to but not including 13.11.7, all 13.12 series before 13.12.8, and all 14.0 series before 14.0.4. The issue involves a specially crafted design image that allows attackers to read arbitrary files on the server. Root cause and vulnera...

CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

UBUNTU-CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22241

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22241

GitLab CE/EE versions starting from 14.0 are affected by CVE-2021-22241, which enables stored cross-site scripting via a crafted default branch name. The Arch Linux advisory confirms the issue is fixed upstream in GitLab 14.1.2 (issue resolved in 14.1.2-1); other sources list affected ranges as 1...

CVE-2021-22241: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name...

CVE-2021-22234: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

CVE-2020-20741

Beckhoff CX9020 vulnerability (firmware CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6) enables authentication bypass via the CE Remote Display Tool because the Windows CE side does not close the incoming connection after incorrect credentials. This is a remote, network-exposed issue with potential for...

CVE-2020-20741: Undefined Security Weakness

Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020CB3011WEC7HPSv602TC31B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if the credentials ar...