CVE Vulnerability Catalog

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

GitLab CE/EE versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

GitLab CE/EE versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

GitLab CE/EE versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

GitLab CE/EE versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow a user to download package files from a public project due to improper authorization checks.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. Affects versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in PowerInfer (Tiiny-AI) up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. The function gguf_init_from_file in file ggml.c of the GGUF Parser component has an issue with the data_offset argument, leading to out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model, so specific version information is not available; the pull request to fix this issue awaits acceptance.

A vulnerability in sherpa-onnx (k2-fsa) up to 1.13.8. The function OfflineTransducerGreedySearchDecoder::Decode in file offline-transducer-greedy-search-decoder.cc has an issue with the vocab_size argument, leading to buffer overflow. The attack can be launched remotely. The exploit has been made public. If only official model packs with consistent metadata are used, the bug may not be reachable, but the code still contains the vulnerability due to trusting unvalidated model metadata.

A vulnerability in Online Reviewer System (code-projects) version 1.0. Unknown code in file /reviewer/system/system/admins/manage/users/btn_functions.php of the User Profile Update Handler has an issue with the usertype_id argument, leading to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public.

A vulnerability in torchdistill (yoshitomo-matsubara) up to 1.1.5. The function load_ckpt in file torchdistill/common/main_util.py has an issue with the src_ckpt argument, leading to deserialization. The attack needs to be launched locally. The exploit has been published. The project maintainer closed it as duplicate.

A vulnerability in GitLab EE allows an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. Affects versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE contains a flaw in cache key construction that, under certain deployment configurations, allows an authenticated user to poison cached page content served to other users. Affected versions are from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

The Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on data confidentiality, with no impact on integrity and availability.

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.

SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.