CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2024-10925 – Authorization Bypass Through User-Controlled Key in GitLab
https://notcve.org/view.php?id=CVE-2024-10925
03 Mar 2025 — A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML • https://gitlab.com/gitlab-org/gitlab/-/issues/502857 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 1CVE-2025-0475 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2025-0475
03 Mar 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances. • https://gitlab.com/gitlab-org/gitlab/-/issues/513142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8186 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-8186
03 Mar 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations. • https://gitlab.com/gitlab-org/gitlab/-/issues/480751 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •