chainguard/gitlab-rails-ce-doc-fips-18.5

Vulnerabilities (28)

• CVE-2026-1182Mar 12, 2026
  affected < 18.5.5-r1fixed 18.5.5-r1

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain

• CVE-2026-0595Feb 11, 2026
  affected < 18.5.5-r0fixed 18.5.5-r0

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML in

• CVE-2026-1458Feb 11, 2026
  affected < 18.5.5-r0fixed 18.5.5-r0

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files.

• CVE-2025-68696HigDec 23, 2025
  affected < 18.5.4-r1fixed 18.5.4-r1

  httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

• CVE-2025-47914Nov 19, 2025
  affected < 0fixed 0

  SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

• CVE-2025-58181Nov 19, 2025
  affected < 0fixed 0

  SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

• CVE-2025-47913Nov 13, 2025
  affected < 18.5.4-r1fixed 18.5.4-r1

  SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

• CVE-2025-64329Nov 7, 2025
  affected < 18.5.1-r3fixed 18.5.1-r3

  containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks

• CVE-2024-25621Nov 6, 2025
  affected < 18.5.1-r3fixed 18.5.1-r3

  containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd

• CVE-2024-8796Sep 17, 2024
  affected < 18.5.1-r2fixed 18.5.1-r2

  Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could ma

• CVE-2024-36361MedMay 24, 2024
  affected < 0fixed 0

  Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and t

• CVE-2024-29034Mar 24, 2024
  affected < 18.5.1-r2fixed 18.5.1-r2

  CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Conte

• CVE-2023-49090Nov 29, 2023
  affected < 18.5.1-r2fixed 18.5.1-r2

  CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a p

• CVE-2021-23383May 4, 2021
  affected < 0fixed 0

  The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

• CVE-2021-23369Apr 12, 2021
  affected < 0fixed 0

  The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

• CVE-2021-21353Mar 3, 2021
  affected < 0fixed 0

  Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug temp

• CVE-2020-7788Dec 11, 2020
  affected < 0fixed 0

  This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

• CVE-2019-20920Sep 30, 2020
  affected < 0fixed 0

  Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing

• CVE-2020-7712Aug 30, 2020
  affected < 0fixed 0

  This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

• CVE-2020-15095Jul 7, 2020
  affected < 0fixed 0

  Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also