Improper Access Control

Gitlab is vulnerable to Improper access control. It is possible for a Guest user to add an emoji on confidential work items...

GitLab 12.1 < 16.4.3 / 16.5 < 16.5.3 / 16.6 < 16.6.1 (CVE-2023-3443)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was...

GitLab 16.5 < 16.5.3 / 16.6 < 16.6.1 (CVE-2023-6396)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: XSS and ReDoS in Markdown via Banzai pipeline of Jira Members with admingroupmember custom permission can add members with higher role Release Description visible in public projects...

Design/Logic Flaw

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items...

CVE-2023-3443 Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items...

CVE-2023-3443

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items...

CVE-2023-3443

GitLab vulnerability CVE-2023-3443 affects GitLab Community and Enterprise Editions, with versions 12.1–16.4.3, 16.5–16.5.2, and 16.6–16.6.0; a Guest user could add an emoji to confidential work items. The issue is documented across multiple sources (NVD/NIST entry, OSV/PRION, and OSV BIT-GITLAB-...

CVE-2023-3443

Removed by vendor...

PT-2023-24871 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 16.4.2 GitLab versions 16.5 through 16.5.2 GitLab versions 16.6 through 16.6.0 Description: An issue has been discovered in GitLab where a Guest user could add an emoji on confidential work items. Recommendations:...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from guest users being ab...

CVE-2023-3443: Incorrect Authorization

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items...

CVE-2022-4007

A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behal...

CVE-2022-4007: Improper Neutralization of Input During Web Page Generation

A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behal...

CVE-2022-4007

Removed by vendor...

MAL-2022-7363 Malicious code in youtrack-exportable-work-items-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f6a061ddcc82ed6b2d87dfc85057460d0e69c829ef7a659fc7b01dfeb1fe17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2012-0748

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...

PT-2012-2839

Name of the Vulnerable Software and Affected Versions IBM Rational Team Concert RTC versions prior to 4.0.0.1 Description The issue affects unspecified services in IBM Rational Team Concert, allowing remote attackers to hijack the authentication of arbitrary users for requests that modify work...

CVE-2012-0748: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in unspecified services in IBM Rational Team Concert RTC 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items...