CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-2242 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2025-2242
27 Mar 2025 — An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects. Una vulnerabilidad de control de acceso inadecuado en GitLab CE/EE que afecta a todas las versiones desde la 17.4 anterior a la 17.8.6, la 17.9 anterior a la 17.9.3 y la 17.10 anterior a la 17.... • https://gitlab.com/gitlab-org/gitlab/-/issues/516271 • CWE-863: Incorrect Authorization •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 1CVE-2025-2255 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2025-2255
27 Mar 2025 — An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec. Se ha detectado un problema en Gitlab EE/CE para AppSec que afecta a todas las versiones desde la 13.5.0 hasta la 17.8.6, la 17.9 hasta la 17.9.3 y la 17.10 hasta la 17.10.1. Algunos mensajes de error podrían permitir ataques de Cross-Site Scripting (XSS) para AppSec. • https://gitlab.com/gitlab-org/gitlab/-/issues/524635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •