Page 12 of 893 results (0.005 seconds)

CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 2

03 Aug 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. • https://gitlab.com/gitlab-org/gitlab/-/issues/417594 • CWE-286: Incorrect User Management CWE-862: Missing Authorization •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge • https://gitlab.com/gitlab-org/gitlab/-/issues/407166 • CWE-262: Not Using Password Aging CWE-284: Improper Access Control •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

02 Aug 2023 — An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code. • https://gitlab.com/gitlab-org/gitlab/-/issues/416252 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 10.0 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de l... • https://gitlab.com/gitlab-org/gitlab/-/issues/416902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la... • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 12.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 1... • https://gitlab.com/gitlab-org/gitlab/-/issues/394775 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

01 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 8.14 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.... • https://gitlab.com/gitlab-org/gitlab/-/issues/415995 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1

01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html). Se ha descubierto un problema en GitLab que afecta ... • https://gitlab.com/gitlab-org/gitlab/-/issues/416161 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 8.0EPSS: 0%CPEs: 3EXPL: 1

21 Jul 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations. • https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released • CWE-840: Business Logic Errors CWE-863: Incorrect Authorization •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch. • https://gitlab.com/gitlab-org/gitlab/-/issues/410123 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •