GitLab Enterprise Edition和GitLab Community Edition 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition and GitLab Community...

CVE-2024-8648: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL...

CVE-2024-7404: Improper Restriction of Rendered UI Layers or Frames

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab Enterprise Edition EE and GitLab Community...

FreeBSD : Gitlab -- vulnerabilities (1eb4d32c-a245-11ef-998c-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1eb4d32c-a245-11ef-998c-2cf05da270f3 advisory. Gitlab reports: Unauthorized access to Kubernetes cluster agent Device OAuth flow allows for...

GitLab 16.0 < 17.3.7 / 17.4.0 < 17.4.4 / 17.5.0 < 17.5.2 (CVE-2024-9693)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition EE and GitLab...

CVE-2024-9693: Incorrect Authorization

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations...

CVE-2024-9633: Incorrect Ownership Assignment

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain,...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to the lack of measures taken to clean up data at the management level, allows a violator to introduce commands into the system.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the lack of measures taken to clean up data at the management level. Exploiting this vulnerability allows a malicious actor to execute commands on the connected Cube...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from context switching errors related to privilege escalation. This allows attackers to increase their privileges and gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to errors in privilege context switching. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and gain unauthorized access to protected information...

PT-2024-8696 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.3 through 17.3.6 GitLab CE/EE versions 17.4 through 17.4.3 GitLab CE/EE versions 17.5 through 17.5.1 Description: An issue has been discovered in GitLab CE/EE where improper output encoding could lead to XSS if CSP is...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition lies in insufficient validation of requests on the server side, allowing attackers to execute SSRF attacks.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks using the user-defined URL address...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the use of a regular expression c with inefficient computational complexity, allowing a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures whe...

Gitlab -- vulnerabilities

Gitlab reports: Unauthorized access to Kubernetes cluster agent Device OAuth flow allows for cross window forgery Denial of Service by importing malicious crafted FogBugz import payload Stored XSS through javascript URL in Analytics dashboards HTML injection in vulnerability Code flow could lead ...

BIT-GITLAB-2022-4315

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to insufficient validation of input data, allows a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from insufficient protection of operational data. This allows attackers to gain access to read, modify, or delete data.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read, modify, or delete access to data...

BIT-GITLAB-2024-6826 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file...

BIT-GITLAB-2024-8312 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS...