U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:gitlab:gitlab:7.10.0:rc1:*:*:community:*:*:*
  • CPE Name Search: true
There are 210 matching records.
Displaying matches 21 through 40.
Vuln ID Summary CVSS Severity
CVE-2018-17536

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 5.4 MEDIUM
V2.0:(not available)
CVE-2018-17455

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2018-17454

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 5.4 MEDIUM
V2.0:(not available)
CVE-2018-17453

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 5.3 MEDIUM
V2.0:(not available)
CVE-2018-17452

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 9.8 CRITICAL
V2.0:(not available)
CVE-2018-17451

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 8.8 HIGH
V2.0:(not available)
CVE-2018-17450

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 4.3 MEDIUM
V2.0:(not available)
CVE-2018-17449

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2018-15472

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.

Published: April 15, 2023; 7:15:13 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-1708

An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.

Published: April 05, 2023; 5:15:07 PM -0400
V3.1: 9.8 CRITICAL
V2.0:(not available)
CVE-2023-1084

An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.

Published: March 09, 2023; 3:15:09 PM -0500
V3.1: 2.7 LOW
V2.0:(not available)
CVE-2022-4138

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.

Published: February 13, 2023; 6:15:11 PM -0500
V3.1: 8.1 HIGH
V2.0:(not available)
CVE-2022-4205

In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.

Published: January 27, 2023; 5:15:08 PM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2022-4037

An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.

Published: January 11, 2023; 11:15:09 PM -0500
V3.1: 8.5 HIGH
V2.0:(not available)
CVE-2022-3613

An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.

Published: January 11, 2023; 11:15:08 PM -0500
V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2022-3514

An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.

Published: January 11, 2023; 11:15:08 PM -0500
V3.1: 5.3 MEDIUM
V2.0:(not available)
CVE-2022-3818

An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.

Published: November 09, 2022; 7:15:22 PM -0500
V3.1: 5.3 MEDIUM
V2.0:(not available)
CVE-2022-3265

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

Published: November 09, 2022; 6:15:13 PM -0500
V3.1: 5.4 MEDIUM
V2.0:(not available)
CVE-2022-3288

A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

Published: October 17, 2022; 12:15:22 PM -0400
V3.1: 4.3 MEDIUM
V2.0:(not available)
CVE-2022-3283

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.

Published: October 17, 2022; 12:15:22 PM -0400
V3.1: 7.5 HIGH
V2.0:(not available)