Vulnerabilidades en GitLab

1068 resultados
Análisis Vexday

Com 1.068 CVEs catalogadas e 78 novas surgidas nos últimos 90 dias, o GitLab apresenta um volume de vulnerabilidades que exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com 4 CVEs confirmadas em uso por agentes de ameaça, mas a presença de 83 vulnerabilidades com prova de conceito pública e 24 de severidade crítica amplia consideravelmente a superfície de risco. O destaque mais preocupante é CVE-2021-22205, atualmente a CVE mais perigosa em exploração ativa, com EPSS de 0,9973 — valor que indica probabilidade altíssima de exploração —, e cuja falha de tipo mais recorrente na plataforma, CWE-770 (alocação de recursos sem limites adequados), sugere atenção redobrada a controles de validação de entrada e gestão de recursos. Equipes de segurança devem priorizar a remediação das CVEs com PoC disponível e manter rastreamento próximo das novas emissões, dado o ritmo relevante de descobertas recentes.

CVE-2022-0488LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a paEPSS 0.7%CVE-2022-2326MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versioEPSS 0.7%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2020-13331MEDIUMAn issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.EPSS 0.7%CVE-2024-2800MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.7%CVE-2020-13276HIGHUser is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 1EPSS 0.7%CVE-2021-39911LOWAn improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.EPSS 0.7%CVE-2023-3210MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.7%CVE-2022-2882MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 beforeEPSS 0.7%CVE-2022-3818MEDIUMAn uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, aEPSS 0.7%CVE-2022-2459LOWAn issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions EPSS 0.7%CVE-2022-2761MEDIUMAn information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15EPSS 0.7%CVE-2022-2865HIGHA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3EPSS 0.7%CVE-2022-3018MEDIUMAn information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 1EPSS 0.7%CVE-2021-22240MEDIUMImproper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap beEPSS 0.7%CVE-2022-4462MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.EPSS 0.7%CVE-2022-3351MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15EPSS 0.7%CVE-2023-4011MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.7%CVE-2021-22189MEDIUMStarting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for theEPSS 0.7%CVE-2022-2533MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2EPSS 0.7%