26 matches found
CVE-2024-6678
CVE-2024-6678 - GitLab: Pipeline Schedule Arbitrary User Trigger CVE-2024-6678 的 PoC 漏洞描述 GitLab 允许用户通过「Play」按钮手动触发 CI/CD 流水线计划（Pipeline Schedules）。该漏洞在于，「play」功能允许拥有 Developer 权限的任何用户 （而不仅仅是计划所有者）触发该计划。这会导致两个后果： 1. 开发者触发了一个由更高权限用户（Maintainer / Owner）创建和配置的计划。 2. 触发的流水线继承了计划中的环境变量（包括敏感变量），尽管...
EUVD-2021-26251
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2023-2022
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting...
CVE-2021-39895
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...
BIT-GITLAB-2021-39895
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...
BIT-GITLAB-2023-2022 Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
GitLab 8.0 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39895)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active ...
Improper Access Control
gitlab is vulnerable to Improper Access Control. The vulnerability allows developers to create pipeline schedules on protected branches, even without merge access...
GitLab 0 < 16.0.8 / 16.1.0 < 16.1.3 / 16.2.0 < 16.2.2 (CVE-2023-2022)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to...
CVE-2023-2022
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
UBUNTU-CVE-2023-2022
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
Code injection
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
CVE-2023-2022
Removed by vendor...
CVE-2023-2022 Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
CVE-2023-2022
CVE-2023-2022 affects GitLab CE/EE: versions before 16.0.8, and 16.1 before 16.1.3, and 16.2 before 16.2.2 are vulnerable to a missing-authorization issue that allows developers to create pipeline schedules on protected branches without merging access. The root cause is not explicitly detailed in...
CVE-2023-2022
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have...
PT-2023-17418 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 16.0.8 GitLab CE/EE versions 16.1 prior to 16.1.3 GitLab CE/EE versions 16.2 prior to 16.2.2 Description: An issue has been discovered in GitLab CE/EE, which allows developers to create pipeline schedules on...
Gitlab -- Vulnerabilities
Gitlab reports: ReDoS via ProjectReferenceFilter in any Markdown fields ReDoS via AutolinkFilter in any Markdown fields Regex DoS in Harbor Registry search Arbitrary read of files owned by the "git" user via malicious tar.gz file upload using GitLab export functionality Stored XSS in Web IDE Beta...
CVE-2021-39895
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...
CVE-2021-39895
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...