CVE-2023-3443 Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from guest users being ab...

PT-2023-24871 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 16.4.2 GitLab versions 16.5 through 16.5.2 GitLab versions 16.6 through 16.6.0 Description: An issue has been discovered in GitLab where a Guest user could add an emoji on confidential work items. Recommendations:...

CVE-2022-4007

A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behal...

CVE-2022-4007

Removed by vendor...

MAL-2022-7363 Malicious code in youtrack-exportable-work-items-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f6a061ddcc82ed6b2d87dfc85057460d0e69c829ef7a659fc7b01dfeb1fe17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

CVE-2012-0748

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...