Vulnerabilidades em GitLab

1.129 resultados
Análise Vexday

Com 1.068 CVEs catalogadas e 78 novas surgidas nos últimos 90 dias, o GitLab apresenta um volume de vulnerabilidades que exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com 4 CVEs confirmadas em uso por agentes de ameaça, mas a presença de 83 vulnerabilidades com prova de conceito pública e 24 de severidade crítica amplia consideravelmente a superfície de risco. O destaque mais preocupante é CVE-2021-22205, atualmente a CVE mais perigosa em exploração ativa, com EPSS de 0,9973 — valor que indica probabilidade altíssima de exploração —, e cuja falha de tipo mais recorrente na plataforma, CWE-770 (alocação de recursos sem limites adequados), sugere atenção redobrada a controles de validação de entrada e gestão de recursos. Equipes de segurança devem priorizar a remediação das CVEs com PoC disponível e manter rastreamento próximo das novas emissões, dado o ritmo relevante de descobertas recentes.

CVE-2022-0427HIGHMissing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perforEPSS 0.8%CVE-2022-2498MEDIUMAn issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15EPSS 0.8%CVE-2020-26415MEDIUMInformation about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This aEPSS 0.8%CVE-2020-13339MEDIUMAn issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is EPSS 0.8%CVE-2022-0371MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 beforeEPSS 0.8%CVE-2022-2326MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versioEPSS 0.8%CVE-2021-22221MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 beforeEPSS 0.8%CVE-2021-22251MEDIUMImproper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emaiEPSS 0.8%CVE-2022-3285MEDIUMBypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 aEPSS 0.8%CVE-2021-22253MEDIUMImproper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deplEPSS 0.8%CVE-2022-3067MEDIUMAn issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versioEPSS 0.8%CVE-2023-2485MEDIUMIncorrect Privilege Assignment in GitLabEPSS 0.8%CVE-2023-3210MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2021-22233MEDIUMAn information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project detailsEPSS 0.8%CVE-2023-2069MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.1EPSS 0.8%CVE-2022-2459LOWAn issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions EPSS 0.8%CVE-2021-22185MEDIUMInsufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerabiEPSS 0.8%CVE-2021-39930MEDIUMMissing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attEPSS 0.8%CVE-2021-39916MEDIUMLack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any ExtEPSS 0.8%CVE-2023-1084LOWAn issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versioEPSS 0.8%