CVE Vulnerability Catalog

GitLab EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.

GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

GitLab CE/EE versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a vulnerability that, under certain conditions, could allow an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect authorization of the import target namespace.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges. Affects versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

GitLab CE/EE versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

GitLab CE/EE versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

GitLab CE/EE versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a fixed issue that, under certain conditions, could allow a user to download package files from a public project due to improper authorization checks.

OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. A crafted HDF5 file with malicious grid metadata can cause memory corruption, leading to a heap-based buffer overflow and potential arbitrary code execution.

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization. Affects versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. Affects versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables. Affects versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A SQL injection vulnerability was identified in code-projects Online Reviewer System 1.0 in the file /reviewer/system/system/admins/manage/users/btn_functions.php within the User Update Handler component. Manipulation leads to SQL injection. The attack can be launched remotely. The exploit is publicly available.

A vulnerability in PowerInfer (Tiiny-AI) up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. The function gguf_init_from_file in file ggml.c of the GGUF Parser component has an issue with the data_offset argument, leading to out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model, so specific version information is not available; the pull request to fix this issue awaits acceptance.

A vulnerability in sherpa-onnx (k2-fsa) up to 1.13.8. The function OfflineTransducerGreedySearchDecoder::Decode in file offline-transducer-greedy-search-decoder.cc has an issue with the vocab_size argument, leading to buffer overflow. The attack can be launched remotely. The exploit has been made public. If only official model packs with consistent metadata are used, the bug may not be reachable, but the code still contains the vulnerability due to trusting unvalidated model metadata.

A vulnerability in Online Reviewer System (code-projects) version 1.0. Unknown code in file /reviewer/system/system/admins/manage/users/btn_functions.php of the User Profile Update Handler has an issue with the usertype_id argument, leading to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public.

A vulnerability in torchdistill (yoshitomo-matsubara) up to 1.1.5. The function load_ckpt in file torchdistill/common/main_util.py has an issue with the src_ckpt argument, leading to deserialization. The attack needs to be launched locally. The exploit has been published. The project maintainer closed it as duplicate.