CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9633 – Incorrect Ownership Assignment in GitLab
https://notcve.org/view.php?id=CVE-2024-9633
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks. • https://gitlab.com/gitlab-org/gitlab/-/issues/498257 https://hackerone.com/reports/2759470 • CWE-708: Incorrect Ownership Assignment •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-7404 – Improper Restriction of Rendered UI Layers or Frames in GitLab
https://notcve.org/view.php?id=CVE-2024-7404
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery https://gitlab.com/gitlab-org/gitlab/-/issues/476670 https://hackerone.com/reports/2627925 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8648 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-8648
An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#stored-xss-through-javascript-url-in-analytics-dashboards https://gitlab.com/gitlab-org/gitlab/-/issues/486220 https://hackerone.com/reports/2683863 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8180 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2024-8180
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.3 hasta la 17.3.7, desde la 17.4 hasta la 17.4.4 y desde la 17.5 hasta la 17.5.2. Una codificación de salida incorrecta podría provocar un error XSS si no se habilita CSP. • https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances https://gitlab.com/gitlab-org/gitlab/-/issues/480720 https://hackerone.com/reports/2654010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9693 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-9693
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. Se descubrió un problema en GitLab CE/EE que afectaba a todas las versiones desde la 16.0 anterior a la 17.3.7, desde la 17.4 anterior a la 17.4.4 y desde la 17.5 anterior a la 17.5.2, lo que podría haber permitido el acceso no autorizado al agente de Kubernetes en un clúster con configuraciones específicas. • https://gitlab.com/gitlab-org/gitlab/-/issues/497449 • CWE-863: Incorrect Authorization •