Gitlab

GitLab

1368 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2017-0927

  • EPSS 0.1%
  • Veröffentlicht 21.03.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:03:54

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.

6.5

CVE-2014-8540

  • EPSS 0.32%
  • Veröffentlicht 05.01.2018 16:29:00
  • Zuletzt bearbeitet 21.11.2024 02:19:17

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

5.9

CVE-2017-17716

  • EPSS 0.09%
  • Veröffentlicht 17.12.2017 17:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth...

8.8

CVE-2017-12426

  • EPSS 0.64%
  • Veröffentlicht 14.08.2017 21:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted S...

6.5

CVE-2017-11437

  • EPSS 0.09%
  • Veröffentlicht 02.08.2017 19:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.

6.5

CVE-2017-11438

  • EPSS 0.12%
  • Veröffentlicht 02.08.2017 19:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.

6.1

CVE-2017-8778

Exploit
  • EPSS 0.07%
  • Veröffentlicht 04.05.2017 15:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.

8.2

CVE-2016-9469

Exploit
  • EPSS 0.14%
  • Veröffentlicht 28.03.2017 02:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could...

6.3

CVE-2017-0882

Exploit
  • EPSS 0.18%
  • Veröffentlicht 28.03.2017 02:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

8.8

CVE-2016-4340

Exploit
  • EPSS 2.47%
  • Veröffentlicht 23.01.2017 21:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.