Gitlab — веб-платформа для управления проектами и репозиториями программного кода, работа которой основана на популярной системе контроля версий Git.
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 17.0.8 | 17.0.8 | ||
| 17.0.7 | 17.0.7 | ||
| 17.0.6 | 17.0.6 | ||
| 17.0.5 | 17.0.5 | ||
| 17.0.4 | 17.0.4 | ||
| 17.0.3 | 17.0.3 | ||
| 17.0.2 | 17.0.2 | ||
| 17.0.1 | 17.0.1 | ||
| 17.0.0 | 17.0.0 |
Показывать по
Количество 5 943
CVE-2022-1416
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
CVE-2022-1416
Missing sanitization of data in Pipeline error messages in GitLab CE/E ...
CVE-2022-1413
Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface
CVE-2022-1413
Missing input masking in GitLab CE/EE affecting all versions starting ...
CVE-2022-1413
Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface
CVE-2022-1423
Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches
CVE-2022-1416
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
GHSA-5phj-qv74-pv4w
Missing permission check in Jenkins GitLab Plugin
BDU:2022-03706
Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками контроля доступа, позволяющая нарушителю получить несанкционированный доступ к ограниченным функциям
CVE-2022-30955
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2022-1416 Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling | CVSS3: 4.3 | 1% Низкий | около 4 лет назад |
| CVE-2022-1416 Missing sanitization of data in Pipeline error messages in GitLab CE/E ... | CVSS3: 4.3 | 1% Низкий | около 4 лет назад |
| CVE-2022-1413 Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface | CVSS3: 5.4 | 1% Низкий | около 4 лет назад |
| CVE-2022-1413 Missing input masking in GitLab CE/EE affecting all versions starting ... | CVSS3: 5.4 | 1% Низкий | около 4 лет назад |
 | CVE-2022-1413 Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface | CVSS3: 5.4 | 1% Низкий | около 4 лет назад |
| CVE-2022-1423 Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches | CVSS3: 7.1 | 1% Низкий | около 4 лет назад |
| CVE-2022-1416 Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling | CVSS3: 4.3 | 1% Низкий | около 4 лет назад |
| GHSA-5phj-qv74-pv4w Missing permission check in Jenkins GitLab Plugin | CVSS3: 4.3 | 1% Низкий | около 4 лет назад |
 | BDU:2022-03706 Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с недостатками контроля доступа, позволяющая нарушителю получить несанкционированный доступ к ограниченным функциям | CVSS3: 2.7 | 1% Низкий | около 4 лет назад |
| CVE-2022-30955 Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | CVSS3: 6.5 | 1% Низкий | около 4 лет назад |
Уязвимостей на страницу