Bitnami package

gitlab

pkg:bitnami/gitlab

Vulnerabilities (1,073)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2023-3900	Med	4.3	>= 16.1.0, < 16.1.3	16.1.3	Aug 2, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
CVE-2023-3500	Med	4.8	>= 10.0.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed t
CVE-2023-3385	Med	6.3	>= 8.10.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and re
CVE-2023-3364	Hig	7.5	>= 8.14.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads whi
CVE-2023-2164	Med	5.4	>= 15.9.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction
CVE-2023-1210	Low	3.1	>= 12.9.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membe
CVE-2023-0632	Med	6.5	>= 15.2.0, < 16.0.8	16.0.8	Aug 2, 2023	An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Ha
CVE-2023-1401	Med	5.0	>= 3.0.29, < 4.0.5	4.0.5	Jul 26, 2023	An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
CVE-2023-3102	Med	5.3	>= 16.0.0, < 16.0.6	16.0.6	Jul 21, 2023	A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
CVE-2023-3484	Hig	8.0	>= 12.8.0, < 15.11.11	15.11.11	Jul 21, 2023	An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situ
CVE-2023-3444	Med	5.7	>= 15.3.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.
CVE-2023-3424	Hig	7.5	>= 10.3.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads t
CVE-2023-3363	Low	3.9	>= 13.6.0, < 15.11.10	15.11.10	Jul 13, 2023	An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.
CVE-2023-3362	Med	5.3	>= 16.0.0, < 16.0.6	16.0.6	Jul 13, 2023	An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
CVE-2023-2620	Med	5.5	>= 15.1.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other m
CVE-2023-2576	Med	4.3	>= 13.7.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected b
CVE-2023-2200	Med	4.1	>= 7.14.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.
CVE-2023-2190	Med	6.5	>= 13.10.0, < 15.11.10	15.11.10	Jul 13, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork cr
CVE-2023-1936	Low	3.5	>= 13.7.0, < 15.11.10	15.11.10	Jul 11, 2023	An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service
CVE-2023-2232	Med	6.5	>= 15.10.0, < 16.1.0	16.1.0	Jun 28, 2023	An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix

CVE-2023-3900MedAug 2, 2023
affected >= 16.1.0, < 16.1.3fixed 16.1.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
CVE-2023-3500MedAug 2, 2023
affected >= 10.0.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed t
CVE-2023-3385MedAug 2, 2023
affected >= 8.10.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and re
CVE-2023-3364HigAug 2, 2023
affected >= 8.14.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads whi
CVE-2023-2164MedAug 2, 2023
affected >= 15.9.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction
CVE-2023-1210LowAug 2, 2023
affected >= 12.9.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membe
CVE-2023-0632MedAug 2, 2023
affected >= 15.2.0, < 16.0.8fixed 16.0.8
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Ha
CVE-2023-1401MedJul 26, 2023
affected >= 3.0.29, < 4.0.5fixed 4.0.5
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
CVE-2023-3102MedJul 21, 2023
affected >= 16.0.0, < 16.0.6fixed 16.0.6
A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
CVE-2023-3484HigJul 21, 2023
affected >= 12.8.0, < 15.11.11fixed 15.11.11
An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situ
CVE-2023-3444MedJul 13, 2023
affected >= 15.3.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.
CVE-2023-3424HigJul 13, 2023
affected >= 10.3.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads t
CVE-2023-3363LowJul 13, 2023
affected >= 13.6.0, < 15.11.10fixed 15.11.10
An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.
CVE-2023-3362MedJul 13, 2023
affected >= 16.0.0, < 16.0.6fixed 16.0.6
An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
CVE-2023-2620MedJul 13, 2023
affected >= 15.1.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other m
CVE-2023-2576MedJul 13, 2023
affected >= 13.7.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected b
CVE-2023-2200MedJul 13, 2023
affected >= 7.14.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.
CVE-2023-2190MedJul 13, 2023
affected >= 13.10.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork cr
CVE-2023-1936LowJul 11, 2023
affected >= 13.7.0, < 15.11.10fixed 15.11.10
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service
CVE-2023-2232MedJun 28, 2023
affected >= 15.10.0, < 16.1.0fixed 16.1.0
An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix

Page 26 of 54