Gitlab -- Vulnerabilities

2024-12-12 · CVE-2024-11274, CVE-2024-8233, CVE-2024-9387, CVE-2024-8647, CVE-2024-8179, CVE-2024-8116, CVE-2024-8650, CVE-2024-9367, CVE-2024-12292, CVE-2024-12292, CVE-2024-10043 · VuXML entry

Gitlab reports: Injection of Network Error Logging (NEL) headers in kubernetes proxy response could lead to ATO abusing OAuth flows Denial of Service by repeatedly sending unauthenticated requests for diff-files CI_JOB_TOKEN could be used to obtain GitLab session Open redirect in releases API Client-Side Path Traversal in Harbor artifact links HTML injection in vulnerability details could lead to Cross Site …

Affected versions

• gitlab-ce, gitlab-ee >= 17.6.0 < 17.6.2; >= 17.5.0 < 17.5.4; >= 9.4.0 < 17.4.6

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.