Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,568 results · page 15 of 32
May 3, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1.CVE-2023-0155 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.CVE-2023-31485 · Websites & servers · Gitlab\ · reported by MITREMedium 5.9
GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.
- Product
- \
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6.CVE-2019-14944 · Websites & servers · Gitlab · reported by MITREMedium 6.5
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6.CVE-2019-14942 · Websites & servers · Gitlab · reported by MITREMedium 5.9
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17537 · Websites & servers · Gitlab · reported by MITREMedium 5.4
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17536 · Websites & servers · Gitlab · reported by MITREMedium 5.4
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17455 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17454 · Websites & servers · Gitlab · reported by MITREMedium 5.4
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17453 · Websites & servers · Gitlab · reported by MITREMedium 5.3
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17452 · Websites & servers · Gitlab · reported by MITRECritical 9.8
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17451 · Websites & servers · Gitlab · reported by MITREHigh 8.8
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17450 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-17449 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 15, 2023An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.CVE-2018-15472 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1.CVE-2023-1787 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allCVE-2023-1710 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable chCVE-2023-1708 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1.CVE-2023-1417 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from CVE-2023-1167 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fromCVE-2023-1071 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1.CVE-2023-0838 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1.CVE-2023-0450 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10CVE-2023-1733 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.8
A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from CVE-2023-1098 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.8
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1.CVE-2023-0523 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starCVE-2023-0319 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starCVE-2022-3513 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions staCVE-2022-3375 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulCVE-2023-0326 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.
- Product
- GitLab DAST API scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless CVE-2022-3767 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.7
Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.
- Product
- DAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starCVE-2022-3758 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions startCVE-2023-1072 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starCVE-2023-0050 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions sCVE-2022-4331 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starCVE-2023-0223 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2.CVE-2022-4289 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2.CVE-2022-3381 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.CVE-2023-1084 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.7
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starCVE-2023-0483 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starCVE-2022-4462 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.CVE-2022-4317 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.
- Product
- DAST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every requeCVE-2022-4315 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cCVE-2022-4007 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versionCVE-2023-0518 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and CVE-2022-4138 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versionCVE-2022-3759 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated aCVE-2022-3411 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in thCVE-2022-4206 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5
A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report
- Product
- DAST API scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user emaiCVE-2022-4255 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.CVE-2022-4205 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.3
In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.