Page 9 of 365 results (0.002 seconds)

CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 8.14 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.1.3, a todas las versiones a partir de la 16.2 antes de la 16.2.2. Una Denegación de Servicio de Expresión Regular era posible a través del envío de payloads crafteados que utilizan AutolinkFilter al endpoint preview_markdown. • https://gitlab.com/gitlab-org/gitlab/-/issues/415995 https://hackerone.com/reports/1959727 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html). Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 8.10 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. En determinadas circunstancias, un usuario que importaba un proyecto "desde exportación" podía acceder a archivos no relacionados y leerlos mediante la carga de un archivo especialmente diseñado. • https://gitlab.com/gitlab-org/gitlab/-/issues/416161 https://hackerone.com/reports/2032730 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 1

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field. • https://gitlab.com/gitlab-org/gitlab/-/issues/408281 https://hackerone.com/reports/1935628 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-116: Improper Encoding or Escaping of Output •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json https://gitlab.com/gitlab-org/gitlab/-/issues/406764 https://hackerone.com/reports/1908423 •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2013.json https://gitlab.com/gitlab-org/gitlab/-/issues/406844 https://hackerone.com/reports/1940441 •