CVE-2024-1066

An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay...

CVE-2023-6840

An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR...

CVE-2023-6736

CVE-2023-6736 – GitLab EE DoS via CODEOWNERS . Affected: GitLab EE versions 11.3–16.7.6, 16.8 (before 16.8.3), and 16.9 (before 16.9.1). Description: attacker could trigger a client-side denial of service by supplying malicious content in the CODEOWNERS file. Impact: DoS on affected clients; no r...

CVE-2023-6840

Removed by vendor...

CVE-2023-6840 Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR...

CVE-2024-1066 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay...

CVE-2024-1066

CVE-2024-1066 affects GitLab EE and allows resource exhaustion via GraphQL vulnerabilitiesCountByDay. Affected are GitLab EE versions: 13.3.0 up to but not including 16.6.7, 16.7 up to but not including 16.7.5, and 16.8 up to but not including 16.8.2. The underlying issue is a lack of throttling/...

CVE-2024-1066

Removed by vendor...

Improper Access Control

GitLab EE is vulnerable to Improper Access Control. The vulnerability is caused due to a flaw in authorization check while approving previously approved merged request. This flaw can be exploited to bypass CODEOWNERS approval by adding changes to a previously approved merge request...

open24.ee Cross Site Scripting vulnerability OBB-3845953

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-6159

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...

Input validation

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...

CVE-2023-6159 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a Cargo.toml containing maliciously crafted input...

CVE-2023-6159

CVE-2023-6159 affects GitLab CE/EE versions 12.7–16.6.5, 16.7.0–16.7.3, and 16.8.0–16.8.0; it enables a Regular Expression Denial of Service when processing a crafted Cargo.toml. The root cause is an inefficient regex handling in input processing. GitLab has released patched versions (e.g., 16.8....

CVE-2023-6159

Removed by vendor...

Input validation

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2023-5933 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests...

CVE-2023-5933

CVE-2023-5933 affects GitLab CE/EE. The issue is in the handling of user name input, where improper input sanitization enables arbitrary API PUT requests. Affected versions are all releases after 13.7 and before 16.6.6, versions 16.7 before 16.7.4, and versions 16.8 before 16.8.1. The reference d...

CVE-2024-0402

CVE-2024-0402: A path traversal flaw in GitLab CE/EE allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. Affected versions are 16.0–16.0.x up to 16.6.5, 16.7.x up to 16.7.3, and 16.8.x up to 16.8.0. Exploitation details are not provi...