Debian Gitlab vulnerabilities

CVE-2021-22183 [MEDIUM] CVE-2021-22183: gitlab - An issue has been discovered in GitLab affecting all versions starting with 11.8... An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-2200 [MEDIUM] CVE-2023-2200: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field. Scope: local sid: resolved (fixed in 15.11.11+ds1-1)

CVE-2021-22196 [MEDIUM] CVE-2021-22196: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39898 [LOW] CVE-2021-39898: gitlab - In all versions of GitLab CE/EE since version 10.6, a project export leaks the e... In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13352 [LOW] CVE-2020-13352: gitlab - Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when... Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, =13.4, =13.5, <13.5.2. Scope: local sid: resolved (fixed in 13.3.9-1)

CVE-2019-15739 [MEDIUM] CVE-2019-15739: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 1... An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2018-9243 [MEDIUM] CVE-2018-9243: gitlab - GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable t... GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7. Scope: local sid: resolved (fixed in 10.6.3+dfsg-1)

CVE-2022-0489 [LOW] CVE-2022-0489: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting wit... An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2018-9244 [MEDIUM] CVE-2018-9244: gitlab - GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable t... GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7. Scope: local sid: resolved (fixed in 10.6.3+dfsg-1)

CVE-2017-0924 [MEDIUM] CVE-2017-0924: gitlab - Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validatio... Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting. Scope: local sid: resolved (fixed in 10.5.5+dfsg-1)

CVE-2019-12444 [MEDIUM] CVE-2019-12444: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 1... An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2019-12442 [MEDIUM] CVE-2019-12442: gitlab - An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epi... An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2023-5831 [LOW] CVE-2023-5831: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the `super_sidebar_logged_out` feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab versi

CVE-2022-2270 [LOW] CVE-2022-2270: gitlab - An issue has been discovered in GitLab affecting all versions starting from 12.4... An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab was leaking Conan packages names due to incorrect permissions verification. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-4201 [LOW] CVE-2022-4201: gitlab - A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior... A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-39907 [MEDIUM] CVE-2021-39907: gitlab - A potential DOS vulnerability was discovered in GitLab CE/EE starting with versi... A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-26417 [MEDIUM] CVE-2020-26417: gitlab - Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes privat... Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to =13.5 to =13.1 to <13.4.7. Scope: local sid: resolved (fixed in 13.4.7-1)

CVE-2020-26407 [MEDIUM] CVE-2020-26407: gitlab - A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before ... A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project Scope: local sid: resolved (fixed in 13.4.7-1)

CVE-2022-0167 [LOW] CVE-2022-0167: gitlab - An issue has been discovered in GitLab affecting all versions starting from 14.0... An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions. Scope: local sid: reso

CVE-2019-10111 [MEDIUM] CVE-2019-10111: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8... An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page. Scope: local sid: resolved (fixed in 11.8.6+dfsg-1)