IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.7Hoch

CVE-2024-10383Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork

GitLab GitLab VSCode Fork Veröffentlicht: (vor 1 Jahr)

Beschreibung

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
gitlab gitlab 15.11.0 – < 17.3.0
GitLab GitLab VSCode Fork < 1.89.1-1.0.0-dev-20241118094343
gitlab gitlab-web-ide-vscode-fork —

Referenzen und Patches

CPE-Treffer (NVD) (8)
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 15.11.0 < 17.3.0
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 15.11.0 < 17.3.0
  • cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*
  • cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:community:*:*:*
  • cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:community:*:*:*
  • cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:enterprise:*:*:*

Neue CVEs im selben Produkt — GitLab

10.0Kritisch
CVE-2026-110264

Integer Overflow or Wraparound in GitLab

GitLab GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

1.3%EPSS
6.8Mittel
CVE-2026-12664

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a proje…

4.3Mittel
CVE-2026-13319

Authorization Bypass Through User-Controlled Key in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project p…

3.1Niedrig
CVE-2026-14288

Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a pr…

5.9Mittel
CVE-2026-16255

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted …