CVE-2021-39930

Removed by vendor...

CVE-2021-39935

Removed by vendor...

CVE-2021-39935

CVE-2021-39935 affects GitLab CE/EE, with SSRF via the CI Lint API. Affected versions include GitLab 10.5–14.3.5, 14.4.x before 14.4.4, and 14.5.x before 14.5.2. The issue allows unauthorized external users to perform Server-Side Requests. Multiple connected sources corroborate the vulnerability ...

CVE-2021-39917

CVE-2021-39917 affects GitLab CE/EE: a regular expression used by quick actions is vulnerable to catastrophic backtracking, enabling a DOS. Impacted: GitLab versions 12.9–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1. Remediation: upgrade to fixed releases (14.3.6, 14.4.4, or 14.5.2 or newer as applic...

CVE-2021-39917

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking...

CVE-2021-39932

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing co...

CVE-2021-39932

GitLab CE/EE is affected by CVE-2021-39932: all versions from 11.0 up to 14.3.6, all 14.4.x before 14.4.4, and all 14.5.x before 14.5.2 are vulnerable. The issue arises when using large payloads in the diff feature, which can trigger high load times for users reviewing code changes. The provided ...

CVE-2021-39932

Removed by vendor...

CVE-2021-39934

Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2...

CVE-2021-39934

Removed by vendor...

CVE-2021-39916

Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5....

CVE-2021-39916

The CVE-2021-39916 entry describes a lack of an access control check in GitLab EE’s External Status Check feature, enabling any authenticated user to retrieve the configuration of any External Status Check. Affected versions are 14.1–14.3.5, 14.4 before 14.4.4, and 14.5 before 14.5.2. The root ca...

CVE-2021-39916

Removed by vendor...

CVE-2021-39919

CVE-2021-39919 affects GitLab CE/EE: vulnerable in all versions before 14.3.6, all versions from 14.4 before 14.4.4, and all versions from 14.5 before 14.5.2. The reset password token and new user email token are logged, risking information disclosure. Remediation is to upgrade to fixed releases ...

CVE-2021-39919

Removed by vendor...

CVE-2021-39915

CVE-2021-39915: GitLab CE/EE GraphQL API has improper access control that lets an attacker view the names of project access tokens on arbitrary projects. Affected: GitLab versions starting from 13.0 up to before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2. Remediation per sources is to upg...

CVE-2021-39933

CVE-2021-39933 affects GitLab CE/EE: all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. An input handling regex (notes, comments, etc) is vulnerable to catastrophic backtracking, enabling a denial of se...

CVE-2021-39933

Removed by vendor...

CVE-2021-39938

Removed by vendor...

CVE-2021-39938

CVE-2021-39938 : A vulnerable regular expression in GitLab CE/EE allows DoS via specially crafted deploy slash commands. Affected versions: GitLab CE/EE 8.15 before 14.3.6; starting from 14.4 before 14.4.4; starting from 14.5 before 14.5.2. Remediation available by upgrading to patched releases (...