GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE and EE versions 14.10 to before...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 16.6 through 18.2.7 prior, 18.3 through 18.3.3 prior, and 18.4 through 18.4.1 prior, which stems from the potential for a developer...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE and EE versions 17.4 through 18.2...

GitLab 14.10 < 18.2.7 / 18.3 < 18.3.3 / 18.4 < 18.4.1 (CVE-2025-9958)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive...

FreeBSD : Gitlab -- Vulnerabilities (477fdc04-9aa2-11f0-961b-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 477fdc04-9aa2-11f0-961b-2cf05da270f3 advisory. Gitlab reports: Denial of Service issue when uploading specifically crafted JSON files impacts...

GitLab 17.10 < 18.2.7 / 18.3 < 18.3.3 / 18.4 < 18.4.1 (CVE-2025-5069)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Incorrect Ownership Assignment in GitLab CVE-2025-5069 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

GitLab 17.4 < 18.2.7 / 18.3 < 18.3.3 / 18.4 < 18.4.1 (CVE-2025-10868)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Business Logic Errors in GitLab CVE-2025-10868 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

PT-2025-39627

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.6 through 18.2.6 GitLab EE versions 18.3 through 18.3.2 GitLab EE versions 18.4 through 18.4.0 Description A privilege escalation issue exists in GitLab EE. A developer possessing specific group management permissions may...

PT-2025-39624

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.4 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description Certain string conversion methods within the software demonstrate performance degradation when processing...

PT-2025-39628

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.10 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description A security issue exists in GitLab CE/EE that could allow an attacker to inject malicious content,...

PT-2025-39626

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.10 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description An issue exists in GitLab CE/EE that could allow an authenticated user to gain unauthorized access to...

PT-2025-39625

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.2 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description The software contains an issue that allows an attacker to cause uncontrolled CPU consumption, potentially...

PT-2025-39629

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.10 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0 Description An issue exists that could allow Guest users to access sensitive information stored in virtual registry...

CVE-2025-58767 vulnerabilities

Vulnerabilities for packages: logstash, truffleruby, ruby3.2-fluentd-kubernetes-daemonset, gitlab-rails-ce, gitlab-rails-ce-fips, jruby, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.3-fluentd-kubernetes-daemonset...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, blob-csi-fips, confluent-common-docker, octo-sts, docker-credential-ecr-login, custom-pod-autoscaler-operator, stakater-reloader, nvidia-nsight-compute-12.8, local-path-provisioner, terraform-provider-tls-fips, prometheus-node-exporter-fips...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, blob-csi-fips, confluent-common-docker, octo-sts, docker-credential-ecr-login, custom-pod-autoscaler-operator, stakater-reloader, nvidia-nsight-compute-12.8, local-path-provisioner, terraform-provider-tls-fips, prometheus-node-exporter-fips...

GHSA-C2F4-JGMC-Q2R5 vulnerabilities

Vulnerabilities for packages: logstash, truffleruby, ruby3.2-fluentd-kubernetes-daemonset, gitlab-rails-ce, gitlab-rails-ce-fips, jruby, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.3-fluentd-kubernetes-daemonset...

BIT-GITLAB-2025-7337 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by...

BIT-GITLAB-2025-6769 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces...

BIT-GITLAB-2025-6454 Server-Side Request Forgery (SSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences...