Gitlab — веб-платформа для управления проектами и репозиториями программного кода, работа которой основана на популярной системе контроля версий Git.
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 17.0.8 | 17.0.8 | ||
| 17.0.7 | 17.0.7 | ||
| 17.0.6 | 17.0.6 | ||
| 17.0.5 | 17.0.5 | ||
| 17.0.4 | 17.0.4 | ||
| 17.0.3 | 17.0.3 | ||
| 17.0.2 | 17.0.2 | ||
| 17.0.1 | 17.0.1 | ||
| 17.0.0 | 17.0.0 |
Показывать по
Количество 5 943
BDU:2022-01820
Уязвимость программной платформы для совместной работы над кодом GitLab, связанная с установкой предопределённых (hardcoded) паролей для учётных записей, зарегистрированных с использованием провайдера OmniAuth (OAuth, LDAP и SAML), позволяющая нарушителю получить доступ к учетным записям пользователей
CVE-2022-1190
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
CVE-2022-1190
Improper handling of user input in GitLab CE/EE versions 8.3 prior to ...
CVE-2022-1189
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project.
CVE-2022-1189
An issue has been discovered in GitLab CE/EE affecting all versions st ...
CVE-2022-1188
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.
CVE-2022-1188
An issue has been discovered in GitLab CE/EE affecting all versions st ...
CVE-2022-1185
A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file
CVE-2022-1185
A denial of service vulnerability when rendering RDoc files in GitLab ...
CVE-2022-1175
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | BDU:2022-01820 Уязвимость программной платформы для совместной работы над кодом GitLab, связанная с установкой предопределённых (hardcoded) паролей для учётных записей, зарегистрированных с использованием провайдера OmniAuth (OAuth, LDAP и SAML), позволяющая нарушителю получить доступ к учетным записям пользователей | CVSS3: 9.1 | 76% Высокий | больше 4 лет назад |
 | CVE-2022-1190 Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. | CVSS3: 8.7 | 87% Высокий | больше 4 лет назад |
| CVE-2022-1190 Improper handling of user input in GitLab CE/EE versions 8.3 prior to ... | CVSS3: 8.7 | 87% Высокий | больше 4 лет назад |
| CVE-2022-1189 An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project. | CVSS3: 3.1 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1189 An issue has been discovered in GitLab CE/EE affecting all versions st ... | CVSS3: 3.1 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1188 An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible. | CVSS3: 3.7 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1188 An issue has been discovered in GitLab CE/EE affecting all versions st ... | CVSS3: 3.7 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1185 A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1185 A denial of service vulnerability when rendering RDoc files in GitLab ... | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
| CVE-2022-1175 Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. | CVSS3: 8.7 | 82% Высокий | больше 4 лет назад |
Уязвимостей на страницу