CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9367 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2024-9367
12 Dec 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs. • https://gitlab.com/gitlab-org/gitlab/-/issues/496631 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9387 – URL Redirection to Untrusted Site ('Open Redirect') in GitLab
https://notcve.org/view.php?id=CVE-2024-9387
12 Dec 2024 — An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint. • https://gitlab.com/gitlab-org/gitlab/-/issues/496659 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-10043 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-10043
12 Dec 2024 — An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure. • https://gitlab.com/gitlab-org/gitlab/-/issues/499577 • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-12570 – Privilege Context Switching Error in GitLab
https://notcve.org/view.php?id=CVE-2024-12570
12 Dec 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim. • https://gitlab.com/gitlab-org/gitlab/-/issues/494694 • CWE-270: Privilege Context Switching Error •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-12292 – Insertion of Sensitive Information into Log File in GitLab
https://notcve.org/view.php?id=CVE-2024-12292
12 Dec 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs. • https://gitlab.com/gitlab-org/gitlab/-/issues/475211 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-11828 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-11828
26 Nov 2024 — A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch. • https://gitlab.com/gitlab-org/gitlab/-/issues/443559 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8114 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8114
26 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges. • https://gitlab.com/gitlab-org/gitlab/-/issues/480494 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8237 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-8237
26 Nov 2024 — A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file. • https://gitlab.com/gitlab-org/gitlab/-/issues/480900 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6826 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2024-6826
24 Oct 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.2 hasta la 17.3.6, desde la 17.4 hasta la 17.4.3 y desde la 17.5 hasta la 17.5.1. Se podría producir una denegación de servicio al importar un archivo de manifiesto XML manipulado con fines malintenc... • https://gitlab.com/gitlab-org/gitlab/-/issues/472928 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8970 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8970
11 Oct 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. • https://gitlab.com/gitlab-org/gitlab/-/issues/490916 • CWE-863: Incorrect Authorization •