GitLab 11.3 < 14.2.6 / 14.3 < 14.3.4 / 14.4 < 14.4.1 (CVE-2021-39909)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions...

madlib-object-utils安全漏洞

madlib-object-utils is an application. A set of utility functions for working with objects. A security vulnerability exists in madlib-object-utils that allows an attacker to merge object prototypes into it...

CVE-2022-1193

Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances...

Improper access control

Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances...

UBUNTU-CVE-2022-1193

Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances...

CVE-2022-1193

CVE-2022-1193 affects GitLab CE/EE: versions 10.7 before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. Root cause is improper access control, allowing a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances. Remediation pe...

CVE-2022-1193

Removed by vendor...

The vulnerability of the software platform based on Git for collaborative code development on GitLab allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the improper display of code in merge requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to access confidential data, compromise its integrity, and...

CVE-2022-1174

A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests,...

Design/Logic Flaw

A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests,...

UBUNTU-CVE-2022-1174

A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests,...

PT-2022-13691 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.7 through 14.7.7 Gitlab CE/EE versions 14.8 through 14.8.5 Gitlab CE/EE versions 14.9 through 14.9.2 Description: A potential DoS issue was discovered, allowing an attacker to trigger high CPU usage via a specially...

CVE-2021-39908

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code...

UBUNTU-CVE-2021-39908

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code...

GitLab 访问控制错误漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. An Access Control Error vulnerability exists in GitLab CE/EE, which stems from...

GitLab Community Edition和GitLab Enterprise Edition 资源管理错误漏洞

GitLab Enterprise Edition is a content management system GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A resource management error vulnerability exists in GitLab Community Edition CE and Enterprise Edition EE due to insufficient validation of user-supplied input in...

PT-2022-11088 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 0.8.0 through 14.2.5 GitLab CE/EE versions 14.3.0 through 14.3.3 GitLab CE/EE versions 14.4.0 Description: The issue allows certain Unicode characters to be abused, enabling the commitment of malicious code into projects...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in deepmerge-ts that stems from prototype contamination in the defaultMergeRecords function of the deepmerge.ts file...

CVE-2022-0344

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...

CVE-2022-0344

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a...