Vulnerabilidades em GitLab

1.178 resultados
Análise Vexday

Com 1.068 CVEs catalogadas e 78 novas surgidas nos últimos 90 dias, o GitLab apresenta um volume de vulnerabilidades que exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com 4 CVEs confirmadas em uso por agentes de ameaça, mas a presença de 83 vulnerabilidades com prova de conceito pública e 24 de severidade crítica amplia consideravelmente a superfície de risco. O destaque mais preocupante é CVE-2021-22205, atualmente a CVE mais perigosa em exploração ativa, com EPSS de 0,9973 — valor que indica probabilidade altíssima de exploração —, e cuja falha de tipo mais recorrente na plataforma, CWE-770 (alocação de recursos sem limites adequados), sugere atenção redobrada a controles de validação de entrada e gestão de recursos. Equipes de segurança devem priorizar a remediação das CVEs com PoC disponível e manter rastreamento próximo das novas emissões, dado o ritmo relevante de descobertas recentes.

CVE-2020-13285HIGHFor GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.EPSS 1.0%CVE-2021-22168MEDIUMA regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.EPSS 1.0%CVE-2022-1417MEDIUMImproper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9EPSS 1.0%CVE-2020-13324MEDIUMA vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed viEPSS 1.0%CVE-2022-3613MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioEPSS 1.0%CVE-2020-13307LOWA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 faEPSS 1.0%CVE-2023-0756MEDIUMAn issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions sEPSS 1.0%CVE-2021-22264MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.EPSS 1.0%CVE-2021-22244LOWImproper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulneEPSS 1.0%CVE-2021-22234CRITICALAn issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 befEPSS 1.0%CVE-2021-39891MEDIUMIn all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the eEPSS 1.0%CVE-2021-22200MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access EPSS 1.0%CVE-2021-22258MEDIUMThe project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addressesEPSS 1.0%CVE-2021-22176MEDIUMAn issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members toEPSS 1.0%CVE-2021-22182LOWAn issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.EPSS 1.0%CVE-2021-22231LOWA denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile paEPSS 1.0%CVE-2020-13292CRITICALIn GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.EPSS 1.0%CVE-2024-8640HIGHImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabEPSS 1.0%CVE-2021-22241HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripEPSS 1.0%CVE-2021-22193LOWAn issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use ofEPSS 1.0%