GHSA-9XWW-4CJX-6W55 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips...

GHSA-94XW-8RG2-4FMC vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips...

GHSA-RPPQ-5VQ8-CRRP vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-cng-fips...

GHSA-G8V2-8WGJ-GWX8 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips...

GHSA-G797-R4R7-WP94 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips...

GHSA-X774-V4VM-3H8M vulnerabilities

Vulnerabilities for packages: gitlab-rails-ee-fips, gitlab-pages, gitlab-ee-fips, gitlab-pages-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ee, gitlab-cng-fips, gitlab-ee...

GHSA-4XPW-245V-VP2W vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips...

GHSA-V6XP-H7WW-6XQF vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: lazygit, flux, aws-efs-csi-driver-fips, pulumi-language-yaml, sbomqs, go-md2man, bom, gomplate, bazelisk, kube-state-metrics-fips, nri-nginx, docker-credential-acr-env, request-1279, prometheus-postgres-exporter-fips, temporal-ui-server-fips, influx, aws-flb-kinesis,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: lazygit, flux, aws-efs-csi-driver-fips, pulumi-language-yaml, sbomqs, go-md2man, bom, gomplate, bazelisk, kube-state-metrics-fips, nri-nginx, docker-credential-acr-env, request-1279, prometheus-postgres-exporter-fips, temporal-ui-server-fips, influx, aws-flb-kinesis,...

Denial Of Service

GitLab is vulnerable to Denial of Service DoS. The vulnerability is due to the server failing to safely process maliciously crafted files, and attackers can exploit this to consume excessive resources and disrupt the availability of the service...

Regular Expression Denial Of Service

GitLab is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient input validation due to the processing logic for generating links in dependency files using vulnerable regular expressions, and attackers can exploit this by submitting specially crafted...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to access control errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

BIT-GITLAB-2024-12379 Allocation of Resources Without Limits or Throttling in GitLab

A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token...

BIT-GITLAB-2024-3303 Improper Neutralization of Input Used for LLM Prompting in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection...

BIT-GITLAB-2024-7102 Execution with Unnecessary Privileges in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances...

BIT-GITLAB-2024-8266 Execution with Unnecessary Privileges in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances...

BIT-GITLAB-2024-9870 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services...

BIT-GITLAB-2025-0376 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page...

BIT-GITLAB-2025-0516 Incorrect Authorization in GitLab

Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data...