CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-12292 – Insertion of Sensitive Information into Log File in GitLab
https://notcve.org/view.php?id=CVE-2024-12292
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs. • https://gitlab.com/gitlab-org/gitlab/-/issues/475211 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-11828 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-11828
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch. • https://gitlab.com/gitlab-org/gitlab/-/issues/443559 https://hackerone.com/reports/2380264 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-11669 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-11669
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes. • https://gitlab.com/gitlab-org/gitlab/-/issues/501528 • CWE-863: Incorrect Authorization •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8114 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8114
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges. • https://gitlab.com/gitlab-org/gitlab/-/issues/480494 https://hackerone.com/reports/2649822 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8177 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-8177
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry. • https://gitlab.com/gitlab-org/gitlab/-/issues/480706 https://hackerone.com/reports/2637996 • CWE-407: Inefficient Algorithmic Complexity •