CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9633 – Incorrect Ownership Assignment in GitLab
https://notcve.org/view.php?id=CVE-2024-9633
14 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions sta... • https://gitlab.com/gitlab-org/gitlab/-/issues/498257 • CWE-708: Incorrect Ownership Assignment •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8648 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-8648
14 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#stored-xss-through-javascript-url-in-analytics-dashboards • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9693 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-9693
14 Nov 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. Se descubrió un problema en GitLab CE/EE que afectaba a todas las versiones desde la 16.0 anterior a la 17.3.7, desde la 17.4 anterior a la 17.4.4 y desde la 17.5 anterior a la 17.5.2, lo que podría haber permitido el acceso... • https://gitlab.com/gitlab-org/gitlab/-/issues/497449 • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6826 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2024-6826
24 Oct 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.2 hasta la 17.3.6, desde la 17.4 hasta la 17.4.3 y desde la 17.5 hasta la 17.5.1. Se podría producir una denegación de servicio al importar un archivo de manifiesto XML manipulado con fines malintenc... • https://gitlab.com/gitlab-org/gitlab/-/issues/472928 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8312 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-8312
24 Oct 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.10 hasta la 17.3.6, la 17.4 hasta la 17.4.3 y la 17.5 hasta la 17.5.1. Un atacante podría inyectar HTML en el campo de búsqueda global en una vista de diferencias, lo que provocaría un XSS. • https://gitlab.com/gitlab-org/gitlab/-/issues/481819 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8970 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8970
11 Oct 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. • https://gitlab.com/gitlab-org/gitlab/-/issues/490916 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-5005 – Incorrect Provision of Specified Functionality in GitLab
https://notcve.org/view.php?id=CVE-2024-5005
11 Oct 2024 — An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API. • https://gitlab.com/gitlab-org/gitlab/-/issues/462108 • CWE-684: Incorrect Provision of Specified Functionality •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9164 – Missing Authentication for Critical Function in GitLab
https://notcve.org/view.php?id=CVE-2024-9164
11 Oct 2024 — An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches. • https://gitlab.com/gitlab-org/gitlab/-/issues/493946 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8977 – Server-Side Request Forgery (SSRF) in GitLab
https://notcve.org/view.php?id=CVE-2024-8977
10 Oct 2024 — An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks. • https://gitlab.com/gitlab-org/gitlab/-/issues/491060 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9596 – Inclusion of Sensitive Information in Source Code in GitLab
https://notcve.org/view.php?id=CVE-2024-9596
10 Oct 2024 — An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance. • https://gitlab.com/gitlab-org/gitlab/-/issues/493355 • CWE-540: Inclusion of Sensitive Information in Source Code •