Page 17 of 1100 results (0.004 seconds)

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-1066 – Allocation of Resources Without Limits or Throttling in GitLab

https://notcve.org/view.php?id=CVE-2024-1066

07 Feb 2024 — An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay` Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde 13.3.0 anterior a 16.6.7, 16.7 anterior a 16.7.5 y 16.8 anterior a 16.8.2, lo que permite a un atacante agotar los recursos utilizando las `vulnerabilidadesCountByDay` de GraphQL. • https://gitlab.com/gitlab-org/gitlab/-/issues/420341 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 2

CVE-2023-5612 – Missing Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-5612

26 Jan 2024 — An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled. Se descubrió un problema en GitLab que afecta a todas las versiones anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. Era posible leer la dirección de correo electrónico del usuario a través del feed de etiquetas, aunque la visibilidad en ... • https://packetstorm.news/files/id/180704 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-6159 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-6159

26 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.7 anterior a 16.6.6, 16.7 anterior a 16.7.4 y 16.8 anterior a 16.8.1. Era posible que un atacante desencadenara una denegación de servicio de expres... • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-5933 – Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

https://notcve.org/view.php?id=CVE-2023-5933

26 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones posteriores a 13.7 anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. La sanitización inadecuada de la entrada del nombre de usuario permite solicitudes PUT de API arbitrarias. • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2024-0456 – Direct Request ('Forced Browsing') in GitLab

https://notcve.org/view.php?id=CVE-2024-0456

26 Jan 2024 — An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project Existe una vulnerabilidad de autorización en las versiones de GitLab 14.0 anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. Un atacante no autorizado puede asignar usuarios arbitrarios a los MR que crearon dentro del proyecto. • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-285: Improper Authorization CWE-425: Direct Request ('Forced Browsing') •

CVSS: 9.9EPSS: 0%CPEs: 8EXPL: 0

CVE-2024-0402 – Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

https://notcve.org/view.php?id=CVE-2024-0402

26 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 16.0 anterior a 16.6.6, 16.7 anterior a 16.7.4 y 16.8 anterior a 16.8.1, lo que permite a un usuario autenticado escribir archivos en ubicaciones arbitrarias en el serv... • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 1

CVE-2023-2030 – Improper Verification of Cryptographic Signature in GitLab

https://notcve.org/view.php?id=CVE-2023-2030

12 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.2 anterior a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2 en el que un atacante podría modificar los metadatos de las confirmaciones firmadas. • https://gitlab.com/gitlab-org/gitlab/-/issues/407252 • CWE-345: Insufficient Verification of Data Authenticity CWE-347: Improper Verification of Cryptographic Signature •

CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-4812 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-4812

12 Jan 2024 — An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 15.3 anteriores a 16.5.6, todas las versiones desde 16.6 anteriores a 16.6.4, todas las versiones desde 16.7 anteriores a 16.7.2. La ... • https://gitlab.com/gitlab-org/gitlab/-/issues/424398 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •

CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 1

CVE-2023-5356 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-5356

12 Jan 2024 — Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user. Verificaciones de autorización incorrectas en GitLab CE/EE desde todas las versiones desde 8.13 anteriores a 16.5.6, todas las versiones desde 16.6 anteriores a 16.6.4, todas las versiones desde 16.7 anteriores a 16.7.2, pe... • https://gitlab.com/gitlab-org/gitlab/-/issues/427154 • CWE-863: Incorrect Authorization •

CVSS: 10.0EPSS: 93%CPEs: 14EXPL: 19

CVE-2023-7028 – GitLab Community and Enterprise Editions Improper Access Control Vulnerability

https://notcve.org/view.php?id=CVE-2023-7028

12 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 16.1 anterior a 16.1.6, 16.2 anterior a 16.2.9, 16.3 anterior a 16.3.7, 16.4 anterior a 16.4.5, 16.5 a... • https://packetstorm.news/files/id/177587 • CWE-284: Improper Access Control CWE-640: Weak Password Recovery Mechanism for Forgotten Password •