3053 matches found
Code injection
An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author...
CVE-2022-2512
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project member...
Code injection
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an...
Code injection
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to preven...
CVE-2022-2497
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL...
CVE-2022-2498
An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author...
CVE-2022-2095
The CVE-2022-2095 issue affects GitLab CE/EE: versions 13.7–15.0.4, 15.1–15.1.3, and 15.2–15.2.0 are affected by an improper access control check that lets an authenticated user view a public Deploy Key’s fingerprint and name when the key has write permission. GitLab notes that the private key is...
CVE-2022-2459
Removed by vendor...
CVE-2022-2459
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to preven...
CVE-2022-2459
GitLab Enterprise Edition (GitLab EE) is affected by CVE-2022-2459 in affected versions prior to 15.0.5, versions 15.1 before 15.1.4, and versions 15.2 before 15.2.1. Description: an issue could allow email-invited members to join a project even after the group-owner setting to prevent adding mem...
CVE-2022-2500
CVE-2022-2500 affects GitLab CE/EE and is a stored cross-site scripting (XSS) flaw in job error messages. Affected versions include all before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. The flaw allows attackers to perform arbitrary actions on behalf of victims at the client side. Th...
CVE-2022-2501
Removed by vendor...
CVE-2022-2501
GitLab EE vulnerability CVE-2022-2501 is an improper access control issue where an attacker can bypass IP allow-listing to download artifacts, while needing proper permissions. Affected versions include all 12.0–14.x (up to 15.0.5 before 15.0.5), 15.1 before 15.1.4, and 15.2 before 15.2.1. Remedi...
CVE-2022-2501
An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required...
CVE-2022-2534
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration...
CVE-2022-2534
CVE-2022-2534 affects GitLab CE/EE, from 9.3 up to 15.0.4, 15.1.x up to 15.1.3, and 15.2 up to 15.2.0, where GitLab exposed contributor emails due to improper data handling in the Datadog integration. The description in the provided documents does not specify exploit details, specific root cause ...
CVE-2022-2303
GitLab CE/EE CVE-2022-2303 affects all versions before 15.0.5, all 15.1 releases before 15.1.4, and all 15.2 releases before 15.2.1. Root cause: bypass of group-level 2FA by obtaining an access token via the Resource Owner Password Credentials grant. Impact: potential unauthorized access without ...
CVE-2022-2303
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...