Cross site scripting

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

open24.ee Cross Site Scripting vulnerability OBB-3400733

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-0508

GitLab CE/EE contains a vulnerability: improper handling of HTTP header CRLF in the NPM package API allows an open redirect (HTTP response splitting). Affected versions are 15.4–15.10.8, 15.11–15.11.7, and 16.0–16.0.2. Remediations are provided in the cited advisories (patches: 15.10.8, 15.11.7, ...

CVE-2023-0121

CVE-2023-0121 describes a denial-of-service in GitLab CE/EE caused by high resource consumption when processing malicious test report artifacts. Affected versions are: 13.2.4 ≤ v < 15.10.8, 15.11 ≤ v < 15.11.7, and 16.0 ≤ v

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-2013

An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display a...

CVE-2023-1825

CVE-2023-1825 affects GitLab EE, with a vulnerability that allowed disclosure of issue notes to unauthorized users during project export in multiple release lines (15.7–15.10.7, 15.11.0–15.11.6, 16.0.0–16.0.1). The underlying issue is the exposure of issue notes when exporting a project, enabling...

CVE-2023-2015

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform...

CVE-2023-0121

A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test repo...

CVE-2023-0508

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API...

CVE-2023-2015

CVE-2023-2015 concerns GitLab CE/EE with a reflected XSS in abuse report creation, affecting all versions from 15.8 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2. The root cause and impact are described in the provided documents, which state that an attacker could perform arbitrary...

CVE-2023-2199

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the...

CVE-2023-2013

CVE-2023-2013 affects GitLab CE/EE with versions starting from 1.2 up to 15.10.8, versions from 15.11 up to 15.11.7, and 16.0 up to 16.0.2. The issue arises from a discrepancy between the web application display and the Git CLI, which can be abused to social engineer victims into cloning non-trus...

CVE-2023-2013

An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display a...

CVE-2023-2013

Removed by vendor...

CVE-2023-0121

Removed by vendor...

CVE-2023-2485 Incorrect Privilege Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they...

CVE-2023-2199

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the...

CVE-2023-2485

CVE-2023-2485 (GitLab CE/EE) affects GitLab versions 14.1–15.10.7, 15.11–15.11.6, and 16.0–16.0.1. A malicious maintainer can escalate other project members to Owners when importing members from a project where those users are Owners. Root cause and impact are consistently described across source...

CVE-2023-2442

GitLab CE/EE versions affected: 15.11 up to 15.11.6 (15.11.x) and 16.0 up to 16.0.1. The issue is a stored XSS vulnerability triggered by a specially crafted merge request, enabling an attacker to perform arbitrary actions on behalf of victims in the client. Mitigation: upgrade to GitLab 15.11.7 ...