CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-4660 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-4660
12 Sep 2024 — An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates. • https://gitlab.com/gitlab-org/gitlab/-/issues/460892 • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6502 – Incorrect Provision of Specified Functionality in GitLab
https://notcve.org/view.php?id=CVE-2024-6502
22 Aug 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag. • https://gitlab.com/gitlab-org/gitlab/-/issues/470647 • CWE-684: Incorrect Provision of Specified Functionality •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8041 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-8041
22 Aug 2024 — A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer. • https://gitlab.com/gitlab-org/gitlab/-/issues/463092 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2800 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-2800
08 Aug 2024 — ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking. La falla de ReDoS en RefMatcher al hacer coincidir nombres de ramas usando comodines en GitLab EE/CE que afecta a todas las versiones desde 11.3 antes de 17.0.6, 17.1 antes de 17.1.4 y 17.2 antes de 17.2.2 permite la denegación de servicio a través del retroceso de Regex. • https://gitlab.com/gitlab-org/gitlab/-/issues/451293 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-3035 – Authorization Bypass Through User-Controlled Key in GitLab
https://notcve.org/view.php?id=CVE-2024-3035
08 Aug 2024 — A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories. Una vulnerabilidad de verificación de permisos en GitLab CE/EE que afecta a todas las versiones desde 8.12 anterior a 17.0.6, 17.1 anterior a 17.1.4 y 17.2 anterior a 17.2.2 permitió que los tokens LFS leyeran y escribieran en los repositorios propiedad del usuario. • https://gitlab.com/gitlab-org/gitlab/-/issues/452297 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-3958 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2024-3958
08 Aug 2024 — An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 17.0.6, 17.1 anterior a 17.1.4 y 17.2 anterior a 17.2.2. Se encontró un problema que permite a alguien ... • https://gitlab.com/gitlab-org/gitlab/-/issues/456988 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-4207 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-4207
08 Aug 2024 — A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances. Se descubrió un problema de cross-site scripting en GitLab que afecta a todas las versiones a partir de 5.1 anteriores a 17.0.6, a partir de 17.1 anteriores a 17.1.4 y a partir de 17.2 anteriores... • https://gitlab.com/gitlab-org/gitlab/-/issues/458236 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-5423 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-5423
08 Aug 2024 — Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline. Se descubrieron múltiples condiciones de denegación de servicio (DoS) en GitLab CE/EE que afectan a todas las versiones desde 1.0 anterior a 17.0.6, desde 17.1 anterior a 17.1.4 y desde 17.2 anterior a 17.2.2, lo que permit... • https://gitlab.com/gitlab-org/gitlab/-/issues/463807 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6329 – Improper Encoding or Escaping of Output in GitLab
https://notcve.org/view.php?id=CVE-2024-6329
08 Aug 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 8.16 anterior a 17.0.6, desde 17.1 anterior a 17.1.4 y desde 17.2 anterior a 17.2.2, lo que provoca que la interfaz web no pueda representar el diff correctamente ... • https://gitlab.com/gitlab-org/gitlab/-/issues/468937 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2024-1493 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-1493
26 Jun 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 9.2 anterior a la 16.11.5, desde la 17.0 anterior a la 17.0.3 y desde la 17.1 anterior a la 17.1.1, con la lógica de procesamiento... • https://gitlab.com/gitlab-org/gitlab/-/issues/441806 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •