Bitnami package
gitlab
pkg:bitnami/gitlab
Vulnerabilities (1,073)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-0805 | Med | 4.9 | >= 15.2.0, < 15.9.6 | 15.9.6 | May 3, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a pu | |
| CVE-2023-0756 | Med | 4.8 | < 15.9.6 | 15.9.6 | May 3, 2023 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories w | |
| CVE-2022-4376 | Low | 3.1 | >= 15.2.0, < 15.9.6 | 15.9.6 | May 3, 2023 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab | |
| CVE-2023-2069 | Med | 6.4 | >= 10.0.0, < 12.9.8 | 12.9.8 | May 3, 2023 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD var | |
| CVE-2023-1965 | Med | 6.8 | >= 14.2.0, < 15.9.6 | 15.9.6 | May 3, 2023 | An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to o | |
| CVE-2023-1836 | Med | 4.4 | >= 5.1.0, < 15.9.6 | 15.9.6 | May 3, 2023 | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be m | |
| CVE-2023-1265 | Med | 5.4 | >= 11.9.0, < 15.9.6 | 15.9.6 | May 3, 2023 | An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain se | |
| CVE-2023-1204 | Med | 4.3 | >= 10.0.0, < 12.9.8 | 12.9.8 | May 3, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sendin | |
| CVE-2023-0485 | Med | 6.5 | >= 15.9.0, < 15.9.4 | 15.9.4 | May 3, 2023 | An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by | |
| CVE-2023-0155 | Med | 5.4 | >= 15.7.0, < 15.10.1 | 15.10.1 | May 3, 2023 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown | |
| CVE-2023-1787 | Med | 4.3 | >= 15.9.0, < 15.9.4 | 15.9.4 | Apr 5, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description. | |
| CVE-2023-1710 | Med | 5.3 | >= 15.0.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue. | |
| CVE-2023-1708 | Med | 5.7 | >= 1.0.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine. | |
| CVE-2023-1417 | Med | 4.3 | >= 15.9.0, < 15.9.4 | 15.9.4 | Apr 5, 2023 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group. | |
| CVE-2023-1167 | Med | 5.3 | >= 12.3.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR. | |
| CVE-2023-1071 | Low | 3.1 | >= 15.5.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue fr | |
| CVE-2023-0838 | Med | 5.5 | >= 15.1.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix | |
| CVE-2023-0450 | Low | 3.7 | >= 8.1.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. | |
| CVE-2023-1733 | Med | 5.8 | >= 11.10.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1. | |
| CVE-2023-1098 | Med | 5.8 | >= 11.5.0, < 15.8.5 | 15.8.5 | Apr 5, 2023 | An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository |
- affected >= 15.2.0, < 15.9.6fixed 15.9.6
An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a pu
- affected < 15.9.6fixed 15.9.6
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories w
- affected >= 15.2.0, < 15.9.6fixed 15.9.6
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab
- affected >= 10.0.0, < 12.9.8fixed 12.9.8
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD var
- affected >= 14.2.0, < 15.9.6fixed 15.9.6
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to o
- affected >= 5.1.0, < 15.9.6fixed 15.9.6
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be m
- affected >= 11.9.0, < 15.9.6fixed 15.9.6
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain se
- affected >= 10.0.0, < 12.9.8fixed 12.9.8
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sendin
- affected >= 15.9.0, < 15.9.4fixed 15.9.4
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by
- affected >= 15.7.0, < 15.10.1fixed 15.10.1
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
- affected >= 15.9.0, < 15.9.4fixed 15.9.4
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.
- affected >= 15.0.0, < 15.8.5fixed 15.8.5
A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.
- affected >= 1.0.0, < 15.8.5fixed 15.8.5
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
- affected >= 15.9.0, < 15.9.4fixed 15.9.4
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
- affected >= 12.3.0, < 15.8.5fixed 15.8.5
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
- affected >= 15.5.0, < 15.8.5fixed 15.8.5
An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue fr
- affected >= 15.1.0, < 15.8.5fixed 15.8.5
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix
- affected >= 8.1.0, < 15.8.5fixed 15.8.5
An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.
- affected >= 11.10.0, < 15.8.5fixed 15.8.5
A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.
- affected >= 11.5.0, < 15.8.5fixed 15.8.5
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository
Page 28 of 54