GitLab 0.0 < 16.2.7 / 16.3 < 16.3.4 (CVE-2023-4998)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Attacker can abuse scan execution policies to run pipelines as another user CVE-2023-4998 Note that Nessus has not tested for this issue but has instead relied only on the application'...

Gitlab -- vulnerability

Gitlab reports: Attacker can abuse scan execution policies to run pipelines as another user...

PT-2023-5448

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.12 through 16.2.7 GitLab EE versions 16.3 through 16.3.4 GitLab Community Edition CE versions 13.12 through 16.2.7 GitLab Community Edition CE versions 16.3 through 16.3.4 Description The issue is related to a flaw in...

GHSA-R726-VMFQ-J9J3 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-R726-VMFQ-J9J3 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-64X5-55RW-9974 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-64X5-55RW-9974 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-39968 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-39968 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-40170 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-40170 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-40024 Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint

ScanCode.io is a server to script and automate software composition analysis pipelines. In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting XSS vulnerability when attempting to access a detailed license vie...

Important: Red Hat Bug Fix Advisory: Red Hat OpenShift Pipelines 1.10.5 release

Red Hat OpenShift Pipelines 1.10.5 General Availability release - A cloud-native Continuous Integration and Delivery solution on OpenShift. Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery CI/CD solution for building pipelines using Tekton. Tekton is a flexible,...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. The library does not perform correct authorizations on scheduled pipelines, which allows a malicious user to run a pipeline in the context of another user resulting in unauthorized access...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. An attacker might use a forged CI job artifact zip file in a project that employs dynamic child pipelines to cause a sidekiq task to use a large amount of RAM. This may result in a Denial of Service on GitLab instances where Sidekiq is...

GHSA-W2H3-VVVQ-3M53 Pipelines do not validate child UIDs

Summary Pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. We should add UID to PipelineRun status and validate that child Run status/results only come from Runs...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Design/Logic Flaw

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...