Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.
CVSS Score
2.0
EPSS Score
0.002
Published
2021-10-04
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.
CVSS Score
4.3
EPSS Score
0.001
Published
2021-10-04
In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
Page 43