CVSS: 8.2EPSS: %CPEs: 3EXPL: 1CVE-2024-8114 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8114
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges. • https://gitlab.com/gitlab-org/gitlab/-/issues/480494 https://hackerone.com/reports/2649822 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6826 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2024-6826
An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.2 hasta la 17.3.6, desde la 17.4 hasta la 17.4.3 y desde la 17.5 hasta la 17.5.1. Se podría producir una denegación de servicio al importar un archivo de manifiesto XML manipulado con fines malintencionados. • https://gitlab.com/gitlab-org/gitlab/-/issues/472928 https://hackerone.com/reports/2571364 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8970 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8970
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. • https://gitlab.com/gitlab-org/gitlab/-/issues/490916 https://hackerone.com/reports/2724948 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-5005 – Incorrect Provision of Specified Functionality in GitLab
https://notcve.org/view.php?id=CVE-2024-5005
An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API. • https://gitlab.com/gitlab-org/gitlab/-/issues/462108 https://hackerone.com/reports/2501461 • CWE-684: Incorrect Provision of Specified Functionality •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 1CVE-2024-9164 – Missing Authentication for Critical Function in GitLab
https://notcve.org/view.php?id=CVE-2024-9164
An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches. • https://gitlab.com/gitlab-org/gitlab/-/issues/493946 https://hackerone.com/reports/2711204 • CWE-306: Missing Authentication for Critical Function •