Gitlab

GitLab

1474 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.5

CVE-2021-39895

  • EPSS 0.98%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:29

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized cond...

5.3

CVE-2021-39897

  • EPSS 1%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:30

Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred

5.3

CVE-2021-39898

  • EPSS 1.25%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:30

In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.

4

CVE-2021-39901

  • EPSS 0.91%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:30

In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint.

4.3

CVE-2021-39904

Exploit
  • EPSS 0.82%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 12.06.2026 14:34:00

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request crea...

4.3

CVE-2021-39905

  • EPSS 0.94%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:31

An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with

6.1

CVE-2021-39906

  • EPSS 60.73%
  • Veröffentlicht 05.11.2021 00:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:31

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

5.4

CVE-2021-22260

Exploit
  • EPSS 0.91%
  • Veröffentlicht 05.11.2021 00:15:08
  • Zuletzt bearbeitet 21.11.2024 05:49:48

A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attack...

6.5

CVE-2021-39903

  • EPSS 1.1%
  • Veröffentlicht 04.11.2021 23:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:31

In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted...

5

CVE-2021-39914

  • EPSS 1.04%
  • Veröffentlicht 04.11.2021 23:15:10
  • Zuletzt bearbeitet 21.11.2024 06:20:32

A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user