GitLab issued emergency patches for a CVSS 10.0 flaw letting attackers run code without logging in, affecting versions back ...
One bug linked a stranger to an existing LDAP account through an email lookup nobody sanitized. The other let an unauthenticated user rewrite the map clients trust to find the identity provider. Same ...
GitLab patched a maximum-severity flaw that lets unauthenticated attackers run code on self-managed servers. Experts say: Patch now.
Ruby patched three Onigmo regex bugs that enabled code execution in GitLab when it compiled attacker-controlled patterns.
GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.
GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in ...
A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project owner, can push code and trigger CI/CD jobs subject to the account’s existing ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results