CVSS: 4.3EPSS: %CPEs: 3EXPL: 1CVE-2024-11828 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-11828
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch. • https://gitlab.com/gitlab-org/gitlab/-/issues/443559 https://hackerone.com/reports/2380264 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 8.2EPSS: %CPEs: 3EXPL: 1CVE-2024-8114 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8114
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges. • https://gitlab.com/gitlab-org/gitlab/-/issues/480494 https://hackerone.com/reports/2649822 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: %CPEs: 3EXPL: 1CVE-2024-8237 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-8237
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file. • https://gitlab.com/gitlab-org/gitlab/-/issues/480900 https://hackerone.com/reports/2648665 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6826 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2024-6826
An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.2 hasta la 17.3.6, desde la 17.4 hasta la 17.4.3 y desde la 17.5 hasta la 17.5.1. Se podría producir una denegación de servicio al importar un archivo de manifiesto XML manipulado con fines malintencionados. • https://gitlab.com/gitlab-org/gitlab/-/issues/472928 https://hackerone.com/reports/2571364 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8970 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-8970
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances. • https://gitlab.com/gitlab-org/gitlab/-/issues/490916 https://hackerone.com/reports/2724948 • CWE-863: Incorrect Authorization •