Yvvdwfon

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 11.6 through 17.2.9 GitLab CE/EE versions 17.3 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 **Description** The issue is related to authentication errors in GitLab, allowing a remote attacker to trigger pipelines as another user under certain circumstances. This can lead to unauthorized access and control over the pipelines. The estimated number of potentially affected devices is not provided. **Recommendations** For GitLab CE/EE versions 11.6 through 17.2.9, upgrade to version 17.2.9 to resolve the issue. For GitLab CE/EE versions 17.3 through 17.3.5, upgrade to version 17.3.5 to resolve the issue. For GitLab CE/EE versions 17.4 through 17.4.2, upgrade to version 17.4.2 to resolve the issue. As a temporary workaround, consider restricting access to pipeline triggers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 16.9 through 16.9.3 GitLab CE/EE versions 16.10 through 16.10.1 **Description** An issue has been discovered in GitLab CE/EE that may lead to a Stored XSS while using the diff viewer. This allows attackers to perform arbitrary actions on behalf of victims. **Recommendations** For GitLab CE/EE versions 16.9 through 16.9.3, update to version 16.9.4 or later. For GitLab CE/EE versions 16.10 through 16.10.1, update to version 16.10.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 16.9 through 16.9.0 **Description** The issue is related to the lack of protection of the web page structure when handling the user profile page, allowing for a stored XSS attack on the client side. This could enable a remote attacker to perform arbitrary actions on behalf of victims by adding a crafted payload to the user profile page. **Recommendations** For GitLab CE/EE versions 16.9 through 16.9.0, update to version 16.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the user profile page until the update is applied. Avoid using the user profile page for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 8.13 through 16.5.6 GitLab CE/EE versions 16.6 through 16.6.4 GitLab CE/EE versions 16.7 through 16.7.2 **Description** The issue is related to incorrect authorization checks in GitLab, allowing a user to abuse Slack/Mattermost integrations to execute slash commands as another user. This can enable a remote attacker to execute arbitrary commands. **Recommendations** For GitLab CE/EE versions 8.13 through 16.5.6, update to version 16.5.6 or later. For GitLab CE/EE versions 16.6 through 16.6.4, update to version 16.6.4 or later. For GitLab CE/EE versions 16.7 through 16.7.2, update to version 16.7.2 or later. As a temporary workaround, consider restricting access to Slack/Mattermost integrations until a patch is applied. Monitor logs for signs of compromise.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 15.10 through 16.0 **Description** An issue has been discovered in GitLab, leading to a ReDoS vulnerability in the Jira prefix. **Recommendations** For GitLab versions 15.10 through 16.0, update to version 16.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 **Description** An issue has been discovered in GitLab CE/EE where a specially crafted merge request could lead to a stored XSS on the client side. This allows attackers to perform arbitrary actions on behalf of victims. **Recommendations** For GitLab CE/EE versions 15.11 through 15.11.6, update to version 15.11.7 or later. For GitLab CE/EE versions 16.0 through 16.0.1, update to version 16.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 15.4 through 15.9.6 GitLab CE/EE versions 15.10 through 15.10.5 GitLab CE/EE versions 15.11 through 15.11.1 **Description** An issue has been discovered in GitLab CE/EE, where under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project. The vulnerability is related to incorrect permission assignment for a critical resource when handling the GraphQL endpoint. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information. **Recommendations** For GitLab CE/EE versions 15.4 through 15.9.6, update to version 15.9.7 to resolve the issue. For GitLab CE/EE versions 15.10 through 15.10.5, update to version 15.10.6 to resolve the issue. For GitLab CE/EE versions 15.11 through 15.11.1, update to version 15.11.2 to resolve the issue. As a temporary workaround, consider restricting access to the GraphQL endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 15.6 through 15.6.1 **Description** An issue has been discovered in GitLab EE due to improper neutralisation of user-supplied input, allowing the creation of a malicious README page. **Recommendations** For GitLab EE versions 15.6 through 15.6.1, update to version 15.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create or edit README pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 12.6 through 15.3.4 GitLab CE/EE versions 15.4 through 15.4.3 GitLab CE/EE versions 15.5 through 15.5.1 **Description** The issue is related to the lack of sand-boxing of OpenAPI documents in GitLab CE/EE, which allows an attacker to trick a user into clicking on the Swagger OpenAPI viewer and issuing HTTP requests that affect the victim's account. **Recommendations** For GitLab CE/EE versions 12.6 through 15.3.4, update to version 15.3.5 or later. For GitLab CE/EE versions 15.4 through 15.4.3, update to version 15.4.4 or later. For GitLab CE/EE versions 15.5 through 15.5.1, update to version 15.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 15.2 through 15.2.4 GitLab CE/EE versions 15.3 through 15.3.3 GitLab CE/EE versions 15.4 through 15.4.0 **Description** A cross-site scripting issue has been discovered in GitLab CE/EE, affecting the external status checks feature. This could lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims at the client side. **Recommendations** For versions 15.2 through 15.2.4, update to version 15.2.5 or later. For versions 15.3 through 15.3.3, update to version 15.3.4 or later. For versions 15.4 through 15.4.0, update to version 15.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 14.9 through 15.1.5 GitLab versions 15.2 through 15.2.3 GitLab versions 15.3 through 15.3.1 **Description** The issue is related to insufficient input validation in GitLab, allowing a remote attacker to inject arbitrary data through the description field in the Incidents Timeline. This could lead to arbitrary requests when a victim interacts with the injected content. An authenticated attacker can exploit this issue. **Recommendations** For GitLab versions 14.9 through 15.1.5, update to version 15.1.6 or later. For GitLab versions 15.2 through 15.2.3, update to version 15.2.4 or later. For GitLab versions 15.3 through 15.3.1, update to version 15.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab versions prior to 15.1.6 GitLab versions 15.2 through 15.2.4 GitLab versions 15.3 through 15.3.2 **Description** The issue is related to insufficient input validation in the ipynb Notebook component of GitLab, a platform for collaborative code work based on git. This can allow a remote attacker to send arbitrary HTTP requests by exploiting a crafted tag in the Jupyter Notebook viewer. **Recommendations** For versions prior to 15.1.6, update to version 15.1.6 or later. For versions 15.2 through 15.2.4, update to version 15.2.5 or later. For versions 15.3 through 15.3.2, update to version 15.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 11.9 and later **Description** The issue is related to client-side code injection through a specially crafted Feature Flag name in GitLab, allowing an attacker to send PUT requests on behalf of other users via a link. This is due to insufficient filtering of Feature Flag descriptions, which can be exploited by a remote attacker to impact data integrity. **Recommendations** For GitLab CE/EE versions 11.9 and later, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6.0 and above Description: A potential Denial of Service (DoS) issue was identified in gitlab-shell, allowing an attacker to increase server resource utilization via the gitlab-shell command. Recommendations: For GitLab CE/EE versions 12.6.0 and above, consider restricting access to the gitlab-shell command as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.2 Description: A vulnerability was discovered in GitLab that made it susceptible to a Server-Side Request Forgery (SSRF) attack. The attack was possible through the Outbound Requests feature. Recommendations: For versions prior to 12.2, update to version 12.2 or later to resolve the issue. As a temporary workaround, consider disabling the Outbound Requests feature until a patch is available. Restrict access to this feature to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.2 and later Description: An issue has been discovered in GitLab, making it vulnerable to a Server-Side Request Forgery (SRRF) attack through the Prometheus integration. Recommendations: For GitLab versions 13.2 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 13.10 and later **Description** The issue is related to a stored XSS in the blob viewer of notebooks, which can be exploited by a remote attacker to impact data integrity. This is due to the lack of protection measures for the web page structure. **Recommendations** For versions 13.10 and later, update to a version that includes the fix for the stored XSS issue in the blob viewer of notebooks. As a temporary workaround, consider disabling the blob viewer of notebooks until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab versions prior to 12.10.13 **Description** An issue has been discovered in GitLab where it is vulnerable to a stored XSS in the blob view feature. **Recommendations** For versions prior to 12.10.13, update to version 12.10.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 **Description** A vulnerability was discovered that makes the Wiki functionality vulnerable to a parser attack, prohibiting access through the user interface. **Recommendations** For versions prior to 13.1.10, update to version 13.1.10 or later. For versions prior to 13.2.8, update to version 13.2.8 or later. For versions prior to 13.3.4, update to version 13.3.4 or later.