Joaxcar

An integer overflow exists in the Onigmo regular expression engine used by GitLab when processing Org mode files with the `.org` extension. This issue occurs when the `org-ruby` library processes user-defined keywords such as `#+TODO:`, `#+SEQ TODO:`, or `#+TYP TODO:` containing a regular expression with more than 32,767 repeats. An unauthenticated remote attacker can exploit this by uploading a specially crafted file to a public project; the vulnerability is triggered when the file's preview page is opened. This can lead to memory corruption and arbitrary code execution on the server, potentially granting access to source code, access tokens, and credentials. Over 10,000 vulnerable instances are estimated to be exposed to the internet.

An issue exists where improper sanitization of path components in the merge request diff viewer could allow an authenticated user to execute arbitrary JavaScript in the context of another user's browser session.

An integer overflow issue exists when compiling a specially crafted regular expression within a CI/CD configuration. This flaw could allow an authenticated user to execute arbitrary code on the server.

An authenticated user can execute arbitrary code on the server due to a double free issue—a memory corruption flaw where the system attempts to free the same memory location twice—occurring when parsing a specially crafted regular expression in a CI/CD configuration. Approximately 1.3 million instances are identified globally.

An issue exists where an unauthenticated user can cause a denial of service. This occurs due to improper resource allocation limits within the GraphQL complexity calculation logic, which manages the computational cost of queries to prevent server overload.

An issue exists in the Web IDE workbench where improper path validation allows an unauthenticated attacker to execute arbitrary JavaScript in a user's browser session via a crafted asset request. This stored Cross-Site Scripting (XSS) can expose CI/CD secrets and source code by gaining access to developer sessions.

An issue exists in GitLab CE/EE where an authenticated user could potentially add unauthorized email addresses to victim accounts. This is possible due to HTML injection within test case titles under specific conditions.

An unauthenticated user could create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

GitLab has addressed an issue that could allow an authenticated user to reveal sensitive information through specially designed merge request titles. The issue affects GitLab CE/EE.

The issue concerns multiple vulnerabilities in GitLab, including Cross-Site Scripting (XSS), Denial of Service (DoS), and Header Injection. These vulnerabilities were addressed in a recent advisory by GitLab.

An issue has been discovered in GitLab CE/EE that could allow an attacker to cause a denial of service by crafting unusual search terms for branch names.

A privacy issue was addressed with improved handling of files. Copying a URL from Web Inspector may lead to command injection. The issue is related to the Web Inspector tool in iOS, iPadOS, macOS, and Safari, which is associated with a lack of data sanitization at the management level. This may allow a remote attacker to execute arbitrary commands.

An issue has been discovered in GitLab CE/EE where improper output encoding could lead to XSS if CSP is not enabled. This could allow a remote attacker to conduct a cross-site scripting attack.

An issue has been discovered in GitLab EE that could allow for an account takeover by breaking the OAuth flow under certain conditions. This is due to an open redirect vulnerability.

A crafted URL could be used to trick a victim into trusting an attacker-controlled application. This issue affects GitLab, allowing potential exploitation through specially made URLs.

An issue has been discovered in GitLab EE due to incomplete input filtering, allowing command injection into a connected Cube server. This issue affects various versions of GitLab EE, making them vulnerable to remote command injection via the Cube Server Handler.

Processing maliciously crafted web content may lead to a cross site scripting attack.

A logic issue was addressed with improved validation. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. The issue is related to insufficient input validation in WebKitGTK and WPE WebKit modules, which may allow a remote attacker to access and compromise confidential data.

The issue is related to errors in handling input data during code syntax analysis, which may allow a remote attacker to execute arbitrary javascript code. This can be achieved through the exploitation of vulnerabilities in the WebKitGTK and WPE WebKit modules, used for displaying web pages.

The issue is related to the WebKit module in Safari and various operating systems, including watchOS, tvOS, iPadOS, iOS, and macOS. It is caused by a lack of protection for the web page structure, which may allow a remote attacker to conduct a cross-site scripting (XSS) attack. Processing a document can lead to this type of attack.