← 返回地图破甲

浏览报告

仅含 CVE

257 份报告 · 本页赏金 $114,620 · 清除筛选

Login email verification bypass via `/oauth/token`.身份认证GitLab低危—2024-09-03 Removed Guest role user who dosent have access to private project in members able to view jobs访问控制GitLab低危—2024-09-18 Remove obsolete domain from handbook subdomain错误配置GitLab低危—2024-10-01 IDOR Exposes All Machine Learning Models不安全的直接对象引用GitLab低危$1,1602024-10-01 Subdomain takeover in Gitlab pages错误配置GitLab低危—2024-10-09 DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server拒绝服务GitLab低危$2,3002024-10-09 Account Takeover via Password Reset without user interactions访问控制GitLab高危$35,0002025-02-26 Stored-XSS injected in Wiki page via Banzai pipeline跨站脚本GitLab中危—2024-05-28 Maintainer can leak sentry token by changing the configured URL (fix bypass)信息泄露GitLab低危—2024-10-08 HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address注入与走私GitLab低危$1,0602024-10-08 Account takeover due to insufficient URL validation on RelayState parameter跨站请求伪造GitLab低危$2,4502023-05-30 Arbitrary escape sequence injection in docker-machine from worker nodes代码执行GitLab低危—2023-06-02 Attacker can create malicious child epics linked to a victim's epic in an unrelated group不安全的直接对象引用GitLab低危$1,1602023-06-02 ReDoS due to device-detector parsing user agents拒绝服务GitLab低危—2024-10-08 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet不安全的直接对象引用GitLab低危$1,7302023-06-02 Stored XSS via Kroki diagram跨站脚本GitLab中危$13,9502023-06-02 No Restriction on password其他弱点GitLab低危—2022-09-13 Bypass: Stored-XSS with CSP-bypass via scoped labels' color跨站脚本GitLab中危—2023-02-19 RepositoryPipeline allows importing of local git repos访问控制GitLab低危$22,3002022-11-04 Dependecy Confusion via Lookup Request Forwarding to PyPi.org错误配置GitLab未评级—2022-11-21 Remote Command Execution via Github import代码执行GitLab高危$33,5102022-10-06 RCE via github import代码执行GitLab高危—2022-11-16 Unauthorized access访问控制GitLab低危—2022-08-25 Stored-XSS with CSP-bypass via labels' color跨站脚本GitLab中危—2023-02-19 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net信息泄露GitLab低危—2022-11-04