CVE-2025-0811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting...

CVE-2025-2242 Incorrect Authorization in GitLab

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...

CVE-2025-2242

CVE-2025-2242 describes an improper access-control vulnerability in GitLab CE/EE that lets a former instance admin, downgraded to a regular user, retain elevated privileges to groups and projects across GitLab versions 17.4 through 17.8.6, 17.9 through 17.9.3, and 17.10 through 17.10.1. The provi...

CVE-2025-2242 Incorrect Authorization in GitLab

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...

CVE-2025-2242

Removed by vendor...

CVE-2025-2242 Incorrect Authorization in GitLab

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...

CVE-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

CVE-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

CVE-2025-2255 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks XSS. for AppSec...

CVE-2025-2255

GitLab EE/CE AppSec is affected by CVE-2025-2255, with XSS due to error messages in versions 13.5.0–before 17.8.6, 17.9–before 17.9.3, and 17.10–before 17.10.1. The issue is rooted in improper output/handling of error messages, allowing cross-site scripting. Several connected sources corroborate ...

CVE-2025-2255

Removed by vendor...

GitLab Enterprise Edition和GitLab Community Edition 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition and GitLab...

GitLab 代码注入漏洞

GitLab is an open source, end-to-end software development platform from US-based GitLab with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A code injection vulnerability exists in GitLab versions prior to 17.10.1,...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition EE and GitLab Community Edition CE A cross-site scripting...

GitLab Enterprise Edition（EE） 命令注入漏洞

GitLab Enterprise Edition EE is a content management system from the US-based GitLab, Inc. A command injection vulnerability exists in GitLab Enterprise Edition EE that stems from improper validation of inputs for the Harbor registration integration. The following versions are affected: versions...

FreeBSD : Gitlab -- Vulnerabilities (1daa2814-0a6c-11f0-b4e4-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1daa2814-0a6c-11f0-b4e4-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting XSS through merge-request error messages Cross-site...

PT-2025-13198 · Gitlab · Gitlab Duo

Name of the Vulnerable Software and Affected Versions: GitLab Duo with Amazon Q versions 17.8 through 17.8.5 GitLab Duo with Amazon Q versions 17.9 through 17.9.2 GitLab Duo with Amazon Q versions 17.10 through 17.10.0 Description: An issue has been discovered in the GitLab Duo with Amazon Q that...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability in GitLab Enterprise Edition EE and GitLab Community Edition ...

PT-2025-12999 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.7 through 17.8.6 GitLab CE/EE versions 17.9 through 17.9.3 GitLab CE/EE versions 17.10 through 17.10.1 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9...

PT-2025-13000 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: Gitlab EE/CE versions 13.5.0 through 17.8.6 Gitlab EE/CE versions 17.9 through 17.9.3 Gitlab EE/CE versions 17.10 through 17.10.1 Description: An issue has been discovered in Gitlab EE/CE for AppSec affecting certain versions. Certain error...