CVE-2023-3993

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

Design/Logic Flaw

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106 Incorrect Authorization in GitLab

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5207

A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user...

CVE-2023-5207

Affected software: GitLab CE/EE. Vulnerability summary: An authenticated attacker could perform arbitrary pipeline execution under the context of another user. Affected versions include GitLab 16.0 and later up to but not including 16.2.8, 16.3 up to but not including 16.3.5, and 16.4 up to but n...

CVE-2023-3115

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositori...

CVE-2023-3906

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

Input validation

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

CVE-2023-3917

Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail...

CVE-2023-0989 Improper Ownership Management in GitLab

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration...

CVE-2023-2233

CVE-2023-2233 – GitLab CE/EE is affected by an improper authorization issue that could allow a project reporter to leak the owner’s Sentry instance projects. Affected versions include 11.8–16.2.8, 16.3–16.3.5, and 16.4–16.4.1. The available documents indicate the root cause as improper authorizat...

CVE-2023-2233

Removed by vendor...

CVE-2023-3115 Incorrect User Management in GitLab

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositori...

CVE-2023-3115

GitLab Enterprise Edition: CVE-2023-3115 describes an issue where Single Sign-On restrictions were not correctly enforced for indirect project members accessing public members-only repositories. Affected versions span 11.11 up to 16.2.8, 16.3 up to 16.3.5, and 16.4 up to 16.4.1. Root cause center...

CVE-2023-3917

Removed by vendor...

CVE-2023-3906

Removed by vendor...

CVE-2023-3906

CVE-2023-3906 describes an input validation issue in GitLab Enterprise Edition’s asset proxy that allows an authenticated attacker to craft image URLs to bypass the asset proxy. Affected versions are 12.3–16.2.7, 16.3.x before 16.3.5, and 16.4.x before 16.4.1. The vulnerability is active in GitLa...

GitLab 11.8 < 16.2.8 / 16.3 < 16.3.5 / 16.4 < 16.4.1 (CVE-2023-2233)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting fro...