Gitlab -- Vulnerabilities

2025-03-26 · CVE-2025-2255, CVE-2025-0811, CVE-2025-2242, CVE-2024-12619, CVE-2024-10307, CVE-2024-9773 · VuXML entry

Gitlab reports: Cross-site Scripting (XSS) through merge-request error messages Cross-site Scripting (XSS) through improper rendering of certain file types Admin Privileges Persists After Role is Revoked External user can access internal projects Prompt injection in Amazon Q integration may allow unauthorized actions Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request …

Affected versions

• gitlab-ce, gitlab-ee >= 17.10.0 < 17.10.1; >= 17.9.0 < 17.9.3; >= 12.10.0 < 17.8.6

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.