Filtered by vendor Gitlab
Subscriptions
Filtered by product Gitlab
Subscriptions
Total
1054 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-0427 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 7.7 High |
| Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover | ||||
| CVE-2022-0283 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 4.7 Medium |
| An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL. | ||||
| CVE-2022-0344 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 3.1 Low |
| An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project | ||||
| CVE-2022-0373 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 4.3 Medium |
| Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address | ||||
| CVE-2022-0244 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 8.6 High |
| An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file. | ||||
| CVE-2022-0249 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 3.1 Low |
| A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked. | ||||
| CVE-2022-0152 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 6.5 Medium |
| An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API. | ||||
| CVE-2022-0172 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 5.3 Medium |
| An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones. | ||||
| CVE-2022-0167 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 3.1 Low |
| An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions. | ||||
| CVE-2022-0125 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 4.3 Medium |
| An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project. | ||||
| CVE-2022-0154 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 7.5 High |
| An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account. | ||||
| CVE-2022-0151 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 6.5 Medium |
| An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions. | ||||
| CVE-2022-0123 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 5.9 Medium |
| An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services. | ||||
| CVE-2022-0090 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 6.5 Medium |
| An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI. | ||||
| CVE-2022-0124 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 4.3 Medium |
| An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack. | ||||
| CVE-2022-0136 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 5.4 Medium |
| A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. | ||||
| CVE-2022-0093 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 3.5 Low |
| An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds. | ||||
| CVE-2023-3444 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 5.7 Medium |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches. | ||||
| CVE-2023-3424 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 7.5 High |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. | ||||
| CVE-2023-3362 | 1 Gitlab | 1 Gitlab | 2024-08-02 | 5.3 Medium |
| An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub. | ||||