Page 11 of 132 results (0.015 seconds)

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-2454 – Allocation of Resources Without Limits or Throttling in GitLab

https://notcve.org/view.php?id=CVE-2024-2454

09 May 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.11 anterior a la 16.9.7, desde la 16.10 anterior a la 16.10.5 y desde la 16.11 anterior a la 16.11.2. El endpoint de los pines es susceptible a DoS a través de una solicitud ... • https://gitlab.com/gitlab-org/gitlab/-/issues/450405 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-2651 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2024-2651

09 May 2024 — An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.9.7, todas las versiones desde 16.10 anteriores a 16.10.5, todas las versiones desde 16.11 anteriores a 16.11.2. Era posible que un atac... • https://gitlab.com/gitlab-org/gitlab/-/issues/450830 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-4539 – Allocation of Resources Without Limits or Throttling in GitLab

https://notcve.org/view.php?id=CVE-2024-4539

09 May 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.4 anterior a la 16.9.7, desde la 16.10 anterior a la 16.10.5 y desde la 16.11 anterior a la 16.11.2, donde se podría abusar de la API para filtrar ramas y et... • https://gitlab.com/gitlab-org/gitlab/-/issues/454815 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-4597 – Cross-Site Request Forgery (CSRF) in GitLab

https://notcve.org/view.php?id=CVE-2024-4597

09 May 2024 — An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 16.7 anteriores a 16.9.7, todas las versiones desde 16.10 anteriores a 16.10.5, todas las versiones desde 16.11 anteriores a 16.11.2. Un atacante podría obligar ... • https://gitlab.com/gitlab-org/gitlab/-/issues/438686 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-4024 – Authentication Bypass by Assumed-Immutable Data in GitLab

https://notcve.org/view.php?id=CVE-2024-4024

25 Apr 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 7.8 an... • https://gitlab.com/gitlab-org/gitlab/-/issues/452426 • CWE-287: Improper Authentication CWE-302: Authentication Bypass by Assumed-Immutable Data •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-4006 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2024-4006

25 Apr 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 16.7 anteriores a 16.9.6, todas las versiones desde 16.10 anteriores a 16.10.4, todas las versiones desde 16.11 anteriores a 16.11.1 donde las suscripciones ... • https://gitlab.com/gitlab-org/gitlab/-/issues/455805 • CWE-863: Incorrect Authorization •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-1347 – Authentication Bypass by Spoofing in GitLab

https://notcve.org/view.php?id=CVE-2024-1347

25 Apr 2024 — An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.9.6, todas las versiones desde 16.10 anteriores a 16.10.4, todas las versiones desde 16.11 anter... • https://gitlab.com/gitlab-org/gitlab/-/issues/441093 • CWE-287: Improper Authentication CWE-290: Authentication Bypass by Spoofing •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-2829 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2024-2829

25 Apr 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.5 anteriores a 16.9.6, todas las versiones desde 16.10 anteriores a 16.10.4, todas las versiones desde 16.11 anteriores a 16.11.1. Un filtro comodín manipul... • https://gitlab.com/gitlab-org/gitlab/-/issues/451456 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2023-6678 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-6678

12 Apr 2024 — An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file. Se descubrió un problema en GitLab EE que afecta a todas las versiones anteriores a 16.8.6, todas las versiones desde 16.9 anteriores a 16.9.4, todas las versiones desde 16.10 anteriores a 16.10.2. Era posible que ... • https://gitlab.com/gitlab-org/gitlab/-/issues/434689 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-2279 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2024-2279

12 Apr 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 16.7 hasta 16.8.6, todas las versiones desde 16.9 anteriores a 16.9.4, t... • https://gitlab.com/gitlab-org/gitlab/-/issues/448469 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •