Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to lack of view permissions on members which allows an attacker to gain access to the members of private groups...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because the requirement to enforce 2FA is not honored when using git commands allowing an attacker to perform unauthorized actions...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. An attacker can cause uncontrolled resource consumption with a maliciously crafted file, leading to an application crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper view permissions which allows an attacker to see pending invitations of any public group or public project by visiting an API endpoint...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because of not managing the sessions properly which allows an attacker with expired password to still access GitLab through git and API through access tokens acquired before password expiration...

Improper Access Control

gitlab is vulnerable to Improper Access Control. An instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call...

Content Spoofing

gitlab is vulnerable to Content Spoofing attacks. The vulnerability allows an attacker to trick users into visiting a malicious website by spoofing the content in an error response...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. The vulnerability exists because of an instance that has the setting to disable Bitbucket Server import enabled allowing an attacker to bypass by making a crafted API call...

Server Side Request Forgery (SSRF)

GitLab CE/EE is vulnerable to Server Side Request Forgery SSRF attacks. The vulnerability is due to DNS rebinding in the Gitea importer, which can be exploited by an attacker to trigger SSRF...

Permission Bypass

GitLab CE/EE is vulnerable to Permission Bypass. The vulnerability is due to insecure authorization, a low level authenticated user can create a project with unlimited size by setting "repositorysizelimit" : 0 in the project import YAML file...

Directory Traversal

gitlab is vulnerable to a directory traversal. An attacker is able to exploit this vulnerability to access arbitrary files on the server by specifying a malicious path in the project deletion request...

Off By One Error

gpac is vulnerable Off by One errors. The vulnerability is due to the gftextgetutf8line function in loadtext.c, which incorrectly checks for the end of a line when reading a text file, resulting in an application crash...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. An attacker can exploit this vulnerability to obtain the email address of the pipeline creator by injecting malicious code into the email address field...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. An attacker could gain access to an integration's access token, which could then be used to impersonate the integration and perform unauthorized actions...

Information Disclosure

haproxy is vulnerable to an Information Disclosure. The vulnerability occurs because GitLab does not properly sanitize the FCGIBEGINREQUEST record. An attacker can exploit this vulnerability by sending a malicious request to GitLab that contains a crafted FCGIBEGINREQUEST record. This will cause...

Directory Traversal

gitLab is vulnerable to a directory traversal. The vulnerability occurs because GitLab does not properly validate the URL of a webhook. An attacker can exploit this vulnerability by creating a malicious webhook with a URL that contains a crafted directory traversal sequence. This will cause GitLa...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to insufficient validation of branch names when importing a project. An authenticated and authorized user can exploit this vulnerability to import a project with a malicious branch name that contains 40 hexadecimal...

Cross-Site Scripting (XSS)

gitlab is vulnerable to a cross-site scripting XSS vulnerability. This vulnerability occurs due to improper neutralization of input during web page generation. An attacker can exploit this vulnerability by creating a malicious Jupyter notebook that contains a crafted tag. When a victim views the...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles large repositories. An attacker can exploit this vulnerability to cause GitLab to exhaust its memory resources, resulting in a denial of service...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to a flaw in the way that GitLab handles group and project visibility. An attacker can exploit this vulnerability to change the visibility of a group or project, even if they are not the owner of the group or project...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles subgroup permissions. An attacker can exploit this vulnerability to gain access to the members list of a parent group, even if they are only a member of the subgroup. This can be...

Cross-site Scripting (XSS)

dokuwiki is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the RSS titles, which allows an attacker to inject and execute malicious javascript...

Cross-Site Scripting (XSS)

firefox is vulnerable to Cross-Site Scripting XSS attacks. This vulnerability occurs due to a flaw in the way that Firefox handles data: URLs. An attacker can exploit this vulnerability to load a malicious document in the same process as a trusted document, bypassing the site-isolation protection...

Remote Code Execution (RCE)

firefox and thunderbird are vulnerable to Remote Code Execution RCE. These vulnerabilities occur due to improper handling of memory in the Firefox web browser. An attacker can exploit these vulnerabilities to crash Firefox or execute arbitrary code...

Remote Code Execution (RCE)

firefox is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to improper handling of memory in the WebRender component. An attacker can exploit this vulnerability to crash Firefox or execute arbitrary code...

Denial Of Service (DoS)

firefox and thunderbird are vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a missing activation delay on the error page for sites with invalid TLS certificates. An attacker can exploit this vulnerability by creating a malicious website that contains a crafted iframe...

Remote Code Execution (RCE)

SABnzbd is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a design flaw in the Notification Script functionality. An attacker can exploit this vulnerability by sending a specially crafted request to the SABnzbd web interface. This can be used to execute arbitrary code o...

Remote Code Execution (RCE)

redis is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Redis handles cJSON and cmsgpack libraries. An attacker can exploit this vulnerability to cause Redis to crash or to execute arbitrary code...

Remote Code Execution (RCE)

gitlab is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that GitLab handles group SAML SSO. An attacker can exploit this vulnerability to invite arbitrary users to a group, and then change the user's email address to an attacker-controlled address. Th...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles confidential notes. An attacker can exploit this vulnerability to view confidential notes that they are not authorized to see...

Remote Code Execution (RCE)

redis is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Redis handles key names. An attacker can exploit this vulnerability to cause Redis to crash or to execute arbitrary code...

Cross-site Scripting (XSS)

odoo is vulnerable to Cross-site Scripting XSS. An attacker can inject and execute malicious javascript through the maliciously crafted links...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles malicious text in the CI Editor and CI Pipeline details page. An attacker can exploit this vulnerability to cause GitLab to consume excessive CPU and memory resources,...

Remote Code Execution (RCE)

mediawiki is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that MediaWiki handles file uploads. An attacker can exploit this vulnerability to bypass file upload restrictions, which could allow them to upload malicious files to the MediaWiki server...

Denial Of Service (DoS)

virtualbox is vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a flaw in the way that Oracle VM VirtualBox handles shared folders. An attacker can exploit this vulnerability to cause a hang or frequently repeatable crash to the victim's system...

Denial Of Service (DoS)

virtualbox is vulnerable to Denial of Service DoS attacks. This vulnerability occurs due to a flaw in the way that Oracle VM VirtualBox handles macro policies. An attacker can exploit this vulnerability to bypass macro security policies, which could allow them to crash the system...

Remote Code Execution (RCE)

virtualbox is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Oracle VM VirtualBox handles RDP connections. An attacker can exploit this vulnerability to execute arbitrary code on the victim's system...

Authorization Bypass

openjfx is vulnerable to Authorization Bypasses. This vulnerability occurs due to a flaw in the way that JavaFX handles image files. An attacker can exploit this vulnerability to execute arbitrary code on a vulnerable system...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles invited group members. An attacker can exploit this vulnerability to gain access to a project even if they have not been invited to the project. This can be used to gain access t...

Cross-Site Scripting (XSS)

gitLab is vulnerable to Cross-Site Scripting XSS. This vulnerability occurs due to a flaw in the way that OrchardCore handles the rendering of HTML templates. An attacker can exploit this vulnerability to inject malicious code into a project's HTML templates, which can then be executed by other...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to a flaw in the way that GitLab handles Jira Connect Namespaces. An attacker can exploit this vulnerability to add or remove Jira Connect Namespaces, even if they do not have the required permissions. This can be used ...

Privilege Escalation

gitlab is vulnerable to Privilege Escalation. This vulnerability occurs due to a flaw in the way that GitLab handles project tokens. An attacker with the "Maintainer" role on any project can exploit this vulnerability to gain the "Internal" role on the same project, which grants them elevated...

Cross-Site Scripting (XSS)

gitLab is vulnerable to Cross-Site Scripting XSS. This vulnerability occurs due to a flaw in the way that GitLab handles the DataDog integration configuration. An attacker can exploit this vulnerability to inject malicious code into a project's DataDog configuration, which can then be executed by...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles the project import/export feature. An attacker can exploit this vulnerability to obtain the private email addresses of users who have exported their projects...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles the /user.keys route. An attacker can exploit this vulnerability to enumerate the usernames of users on the GitLab server, even if the users have not made their usernames public...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles guest user permissions. An attacker can exploit this vulnerability to inject and execute malicious javascript on victim's browser...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles Git over SSH. An attacker can exploit this vulnerability to impersonate any user on the GitLab server, including users with administrative privileges...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker can view and delete impersonation tokens that administrators create...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability allows an attackers in private projects to view CI/CD analytics...

Improper Input Validation

gitlab is vulnerable to Improper Input Validation. The vulnerability exists in the commit author of the library, which allows an attacker to make several pages in a project impossible to view...