Bitnami package
gitlab
pkg:bitnami/gitlab
Vulnerabilities (1,073)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-4647 | Med | 5.3 | >= 15.2.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain | |
| CVE-2023-4378 | Med | 5.5 | >= 11.8.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by c | |
| CVE-2023-4018 | Med | 4.3 | >= 16.2.0, < 16.2.5 | 16.2.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. | |
| CVE-2023-3950 | Med | 5.5 | >= 16.2.0, < 16.2.5 | 16.2.5 | Sep 1, 2023 | An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, | |
| CVE-2023-3915 | Med | 6.5 | >= 16.1.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalat | |
| CVE-2023-3210 | Med | 6.5 | >= 15.11.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicio | |
| CVE-2023-3205 | Med | 6.5 | >= 15.11.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicio | |
| CVE-2023-1555 | Low | 2.7 | >= 15.2.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API. | |
| CVE-2023-1279 | Low | 2.6 | >= 4.1.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. | |
| CVE-2023-0120 | Low | 3.5 | >= 10.0.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an una | |
| CVE-2022-4343 | Med | 5.0 | >= 13.12.0, < 16.1.5 | 16.1.5 | Sep 1, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile. | |
| CVE-2023-4522 | Med | 4.3 | < 16.2.0 | 16.2.0 | Aug 30, 2023 | An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit. | |
| CVE-2023-4002 | Med | 5.3 | >= 14.1.0, < 16.0.8 | 16.0.8 | Aug 4, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to | |
| CVE-2023-4008 | Med | 5.3 | >= 15.9.0, < 16.0.8 | 16.0.8 | Aug 3, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random strin | |
| CVE-2023-3932 | Hig | 8.2 | >= 13.12.0, < 16.0.8 | 16.0.8 | Aug 3, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via schedule | |
| CVE-2023-3401 | Med | 4.8 | < 16.0.8 | 16.0.8 | Aug 2, 2023 | An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with | |
| CVE-2023-2022 | Med | 4.3 | < 16.0.8 | 16.0.8 | Aug 2, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even i | |
| CVE-2023-4011 | Med | 4.3 | >= 15.11.0, < 16.2.2 | 16.2.2 | Aug 2, 2023 | An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS. | |
| CVE-2023-3994 | Hig | 7.5 | >= 9.3.0, < 16.0.8 | 16.0.8 | Aug 2, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads whic | |
| CVE-2023-3993 | Med | 4.9 | >= 14.3.0, < 16.0.8 | 16.0.8 | Aug 2, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. |
- affected >= 15.2.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain
- affected >= 11.8.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by c
- affected >= 16.2.0, < 16.2.5fixed 16.2.5
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.
- affected >= 16.2.0, < 16.2.5fixed 16.2.5
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key,
- affected >= 16.1.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalat
- affected >= 15.11.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicio
- affected >= 15.11.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicio
- affected >= 15.2.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.
- affected >= 4.1.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.
- affected >= 10.0.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an una
- affected >= 13.12.0, < 16.1.5fixed 16.1.5
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.
- affected < 16.2.0fixed 16.2.0
An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
- affected >= 14.1.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to
- affected >= 15.9.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random strin
- affected >= 13.12.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via schedule
- affected < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with
- affected < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even i
- affected >= 15.11.0, < 16.2.2fixed 16.2.2
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
- affected >= 9.3.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads whic
- affected >= 14.3.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.
Page 25 of 54