3058 matches found
CVE-2024-2191
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only...
CVE-2024-2191
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only...
CVE-2024-3115
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat...
CVE-2024-4901
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes...
CVE-2024-6323
Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project...
CVE-2024-5655
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circumstances...
CVE-2024-5430
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL...
CVE-2024-1493
CVE-2024-1493 concerns GitLab CE/EE where the dependency-file link generation logic can trigger a regular-expression DoS on the server. Affected versions are: GitLab 9.2–16.11.4, 17.0.x before 17.0.3, and 17.1.x before 17.1.1. The issue is rooted in how dependency links are generated, leading to ...
CVE-2024-1493 Uncontrolled Resource Consumption in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the serve...
CVE-2024-2191
Removed by vendor...
CVE-2024-2191 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only...
CVE-2024-2191
CVE-2024-2191 (GitLab CE/EE) affects GitLab versions with an improper access control: the merge request title can be publicly visible when the project members setting is used. Affected ranges are: 16.9 up to but not including 16.11.5, 17.0 up to but not including 17.0.3, and 17.1 up to but not in...
CVE-2024-3115
Removed by vendor...
CVE-2024-3115
GitLab Enterprise Edition contains CVE-2024-3115: an issue in GitLab EE that allows an attacker to access issues and epics without an SSO session when using Duo Chat. Affected versions: 16.0–16.11.4, 17.0–17.0.2, and 17.1–17.1.0. MITRE or exploit details are not provided in the documents. Remedia...
CVE-2024-3959
CVE-2024-3959 affects GitLab CE/EE: all versions from 16.7 up to 16.11.5, 17.0 up to 17.0.3, and 17.1 up to 17.1.1. Issue: improper authorization that allows private job artifacts to be accessed by any user. Impact: exposure of private artifacts; no integrity/availability impact stated beyond acc...
CVE-2024-3959 Improper Authorization in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user...
CVE-2024-4557
Removed by vendor...
CVE-2024-4557
CVE-2024-4557 is an active GitLab DoS vulnerability affecting GitLab CE/EE. The issue enables resource exhaustion via the banzai pipeline in affected releases: GitLab 1.0–16.11.4, 17.0–17.0.2, and 17.1–17.1.0 (up to but not including fixed versions). Multiple connected sources describe the root c...
CVE-2024-4901
CVE-2024-4901 affects GitLab CE/EE: a stored XSS vulnerability that could be imported from a project with malicious commit notes. Root cause cited as improper neutralization of input during web page generation. Affected versions: GitLab 16.9–16.11.4, 17.0.0–17.0.2, and 17.1.0–17.1.0 (and similar ...