CVE-2025-0475 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances...

CVE-2025-0475

The CVE-2025-0475 affects GitLab CE/EE versions 15.10 up to 17.7.6, 17.8 up to 17.8.4, and 17.9 up to 17.9.1. A proxy feature could allow unintended content rendering and cross-site scripting (XSS) under specific conditions. Remediation: upgrade to GitLab 17.7.6, 17.8.4, or 17.9.1 (the fixed rele...

CVE-2024-8186 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips...

CVE-2024-8186

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations...

CVE-2024-8186 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2024-8186 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations...

CVE-2024-8186 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations...

CVE-2024-8186

CVE-2024-8186 affects GitLab CE/EE: HTML injection in the child item search can lead to cross-site scripting (XSS) in versions 16.6–16.7.6, 17.8–17.8.3/4, and 17.9–17.9.0/1. GitLab has released fixes in 17.7.6, 17.8.4, and 17.9.1. No exploitation details are provided in the documents; remediation...

CVE-2024-8186 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations...

GitLab 15.10 < 17.7.6 / 17.8 < 17.8.4 / 17.9 < 17.9.1 (CVE-2025-0475)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended conte...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A security vulnerability exists in GitLab Enterprise Edition versions 16.2 through before 17.7.6, 17.8 through before 17.8.4, and 17.9 through before 17.9.1, which stems from the ability of a Guest user ...

CVE-2024-10925: Authorization Bypass Through User-Controlled Key

A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML...

GitLab Enterprise Edition 跨站脚本漏洞

GitLab Enterprise Edition EE is a content management system from the American company GitLab. A cross-site scripting vulnerability exists in GitLab Enterprise Edition versions prior to 16.6 through 17.7.6, versions prior to 17.8 through 17.8.4, and versions prior to 17.9 through 17.9.1 that...

CVE-2025-0555: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions...

CVE-2025-0475: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances...

GitLab 16.6 < 17.7.6 / 17.8 < 17.8.4 / 17.9 < 17.9.1 (CVE-2025-0555)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A Cross Site Scripting XSS vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls an...

CVE-2024-8186: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition EE and GitLab Community Edition CE A cross-site scripting...

GitLab 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A cross-site scripting vulnerability exists in GitLab versions prior to 16.6...

FreeBSD : Gitlab -- Vulnerabilities (8fb9101e-f58a-11ef-b4e4-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8fb9101e-f58a-11ef-b4e4-2cf05da270f3 advisory. Gitlab reports: XSS in k8s proxy endpoint XSS Maven Dependency Proxy HTML injection leads to X...