CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-7060 – Exposure of Sensitive Information to an Unauthorized Actor in GitLab
https://notcve.org/view.php?id=CVE-2024-7060
24 Jul 2024 — An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export. • https://gitlab.com/gitlab-org/gitlab/-/issues/437894 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-7091 – Exposure of Sensitive Information to an Unauthorized Actor in GitLab
https://notcve.org/view.php?id=CVE-2024-7091
24 Jul 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user. • https://gitlab.com/gitlab-org/gitlab/-/issues/408469 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2024-6595 – Uncontrolled Search Path Element in GitLab
https://notcve.org/view.php?id=CVE-2024-6595
17 Jul 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.8 anterior a la 16.11.6, desde la 17.0 anterior a la 17.0.4 y desde la 17.1 anterior a la 17.1.2 donde era posible cargar un paquete NPM con conflictos datos del paquete. • https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem • CWE-427: Uncontrolled Search Path Element CWE-434: Unrestricted Upload of File with Dangerous Type CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2880 – Improper Access Control in GitLab
https://notcve.org/view.php?id=CVE-2024-2880
11 Jul 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group members. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 16.5 anterior a 16.11.6, desde 17.0 anterior a 17.0.4 y desde 17.1 anterior a 17.1.2 en el que un usuario con permiso de rol personalizado `admin_group_member` podría ... • https://gitlab.com/gitlab-org/gitlab/-/issues/451921 • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6385 – Improper Access Control in GitLab
https://notcve.org/view.php?id=CVE-2024-6385
11 Jul 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.8 anterior a la 16.11.6, desde la 17.0 anterior a la 17.0.4 y desde la 17.1 anterior a la 17.1.2, lo que permite a un atacante activar una pipeline como otro ... • https://gitlab.com/gitlab-org/gitlab/-/issues/469217 • CWE-284: Improper Access Control •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2177 – Improper Restriction of Rendered UI Layers or Frames in GitLab
https://notcve.org/view.php?id=CVE-2024-2177
09 Jul 2024 — A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload. Existe una vulnerabilidad de falsificación de ventanas cruzadas dentro de GitLab CE/EE que afecta a todas las versiones desde 16.3 anteriores a 16.11.5, 17.0 anteriores a 17.0.3 y 17.1 anteriores a 17.1.1. Esta condición permite que un atacante abus... • https://gitlab.com/gitlab-org/gitlab/-/issues/444467 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2024-1493 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-1493
26 Jun 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 9.2 anterior a la 16.11.5, desde la 17.0 anterior a la 17.0.3 y desde la 17.1 anterior a la 17.1.1, con la lógica de procesamiento... • https://gitlab.com/gitlab-org/gitlab/-/issues/441806 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2024-1816 – Uncontrolled Resource Consumption in GitLab
https://notcve.org/view.php?id=CVE-2024-1816
26 Jun 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.0 anterior a 16.11.5, desde 17.0 anterior a 17.0.3 y desde 17.1 anterior a 17.1.1, lo que permite que un atacante provoque una denegación de servicio utilizando un a... • https://gitlab.com/gitlab-org/gitlab/-/issues/442852 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2024-2191 – Improper Access Control in GitLab
https://notcve.org/view.php?id=CVE-2024-2191
26 Jun 2024 — An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 16.9 anterior a la 16.11.5, desde la 17.0 anterior a la 17.0.3 y desde la 17.1 anterior a la 17.1.1, lo que permite que el título de la solicitud de fusió... • https://gitlab.com/gitlab-org/gitlab/-/issues/444655 • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2024-3115 – Exposure of Sensitive Information to an Unauthorized Actor in GitLab
https://notcve.org/view.php?id=CVE-2024-3115
26 Jun 2024 — An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 16.0 anterior a 16.11.5, desde 17.0 anterior a 17.0.3 y desde 17.1 anterior a 17.1.1, lo que permite a un atacante acceder a problemas y epics sin tener una Sesión ... • https://gitlab.com/gitlab-org/gitlab/-/issues/452548 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •