1449 matches found
CVE-2021-39916
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5....
CVE-2021-39916
The CVE-2021-39916 entry describes a lack of an access control check in GitLab EE’s External Status Check feature, enabling any authenticated user to retrieve the configuration of any External Status Check. Affected versions are 14.1–14.3.5, 14.4 before 14.4.4, and 14.5 before 14.5.2. The root ca...
CVE-2021-39916
Removed by vendor...
CVE-2021-39915
CVE-2021-39915: GitLab CE/EE GraphQL API has improper access control that lets an attacker view the names of project access tokens on arbitrary projects. Affected: GitLab versions starting from 13.0 up to before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2. Remediation per sources is to upg...
CVE-2021-39938
CVE-2021-39938 : A vulnerable regular expression in GitLab CE/EE allows DoS via specially crafted deploy slash commands. Affected versions: GitLab CE/EE 8.15 before 14.3.6; starting from 14.4 before 14.4.4; starting from 14.5 before 14.5.2. Remediation available by upgrading to patched releases (...
CVE-2021-39945
CVE-2021-39945 affects GitLab CE/EE API. A bug in access control allows an author of a Merge Request to approve the MR even after their project access is revoked, across GitLab versions: 9.4–14.3.6, 14.4–14.4.3, and 14.5–14.5.1. Root cause is improper access restriction in the Merge Request appro...
CVE-2021-39944
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege ...
CVE-2021-39918
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...
CVE-2021-39918: Incorrect Authorization
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows a user to add comments to a vulnerability which cannot be accessed...
CVE-2021-39916: Authorization Bypass Through User-Controlled Key
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5....
CVE-2021-39937: Improper Privilege Management
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances...
CVE-2021-39930: Incorrect Authorization
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates...
Default credentials
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges...
CVE-2021-39906
Removed by vendor...
CVE-2021-39909
The CVE-2021-39909 entry concerns GitLab Enterprise Edition (EE) and describes a lack of email address ownership verification in the CODEOWNERS feature across affected lines: EE from 11.3 up to before 14.2.6, EE 14.3 up to before 14.3.4, and EE 14.4 up to before 14.4.1. This absence can allow an ...
CVE-2021-39909: Improper Verification of Cryptographic Signature
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker to bypass CODEOWNERS Merge Request approval...
CVE-2021-39891
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...
CVE-2021-39880
CVE-2021-39880 affects the apollo_upload_server middleware in GitLab CE/EE (Ruby gem) across all affected GitLab releases: 11.9–14.0.8, 14.1.0–14.1.3, and 14.2.0–14.2.1. The issue allows a Denial of Service via specially crafted requests, denying access to all users. Upstream fixes exist in the c...
CVE-2021-39889
CVE-2021-39889 affects GitLab EE versions from 14.1 onward. An insecure direct object reference in a protected-branch API endpoint may disclose the protected branch name to a malicious user who crafts an API call using the branch ID. Impact is information disclosure (confidentiality) with no inte...