Page 5 of 264 results (0.008 seconds)

CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-11669 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2024-11669

26 Nov 2024 — An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes. • https://gitlab.com/gitlab-org/gitlab/-/issues/501528 • CWE-863: Incorrect Authorization •

CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-8114 – Missing Authorization in GitLab

https://notcve.org/view.php?id=CVE-2024-8114

26 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges. • https://gitlab.com/gitlab-org/gitlab/-/issues/480494 • CWE-862: Missing Authorization •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-8177 – Inefficient Algorithmic Complexity in GitLab

https://notcve.org/view.php?id=CVE-2024-8177

26 Nov 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry. • https://gitlab.com/gitlab-org/gitlab/-/issues/480706 • CWE-407: Inefficient Algorithmic Complexity •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-8237 – Inefficient Algorithmic Complexity in GitLab

https://notcve.org/view.php?id=CVE-2024-8237

26 Nov 2024 — A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file. • https://gitlab.com/gitlab-org/gitlab/-/issues/480900 • CWE-407: Inefficient Algorithmic Complexity •

CVSS: 4.2EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-11668 – Insufficient Session Expiration in GitLab

https://notcve.org/view.php?id=CVE-2024-11668

26 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results. • https://gitlab.com/gitlab-org/gitlab/-/issues/456922 • CWE-613: Insufficient Session Expiration •

CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-9633 – Incorrect Ownership Assignment in GitLab

https://notcve.org/view.php?id=CVE-2024-9633

14 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks. An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions sta... • https://gitlab.com/gitlab-org/gitlab/-/issues/498257 • CWE-708: Incorrect Ownership Assignment •

CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-7404 – Improper Restriction of Rendered UI Layers or Frames in GitLab

https://notcve.org/view.php?id=CVE-2024-7404

14 Nov 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •

CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-8648 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2024-8648

14 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#stored-xss-through-javascript-url-in-analytics-dashboards • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1

CVE-2024-8180 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2024-8180

14 Nov 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.3 hasta la 17.3.7, desde la 17.4 hasta la 17.4.4 y desde la 17.5 hasta la 17.5.2. Una codificación de salida incorrecta podría provocar un error XSS si no se habilita CSP. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-9693 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2024-9693

14 Nov 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. Se descubrió un problema en GitLab CE/EE que afectaba a todas las versiones desde la 16.0 anterior a la 17.3.7, desde la 17.4 anterior a la 17.4.4 y desde la 17.5 anterior a la 17.5.2, lo que podría haber permitido el acceso... • https://gitlab.com/gitlab-org/gitlab/-/issues/497449 • CWE-863: Incorrect Authorization •