CVE Vulnerability Catalog

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization. Affects versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. Affects versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables. Affects versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A SQL injection vulnerability was identified in code-projects Online Reviewer System 1.0 in the file /reviewer/system/system/admins/manage/users/btn_functions.php within the User Update Handler component. Manipulation leads to SQL injection. The attack can be launched remotely. The exploit is publicly available.

A vulnerability in PowerInfer (Tiiny-AI) up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. The function gguf_init_from_file in file ggml.c of the GGUF Parser component has an issue with the data_offset argument, leading to out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model, so specific version information is not available; the pull request to fix this issue awaits acceptance.

A vulnerability in sherpa-onnx (k2-fsa) up to 1.13.8. The function OfflineTransducerGreedySearchDecoder::Decode in file offline-transducer-greedy-search-decoder.cc has an issue with the vocab_size argument, leading to buffer overflow. The attack can be launched remotely. The exploit has been made public. If only official model packs with consistent metadata are used, the bug may not be reachable, but the code still contains the vulnerability due to trusting unvalidated model metadata.

A vulnerability in Online Reviewer System (code-projects) version 1.0. Unknown code in file /reviewer/system/system/admins/manage/users/btn_functions.php of the User Profile Update Handler has an issue with the usertype_id argument, leading to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public.

A vulnerability in torchdistill (yoshitomo-matsubara) up to 1.1.5. The function load_ckpt in file torchdistill/common/main_util.py has an issue with the src_ckpt argument, leading to deserialization. The attack needs to be launched locally. The exploit has been published. The project maintainer closed it as duplicate.

A vulnerability in GitLab EE allows an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a vulnerability that, under certain conditions, could allow an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

A vulnerability in GitLab CE/EE allows an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. Affects versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE contains a flaw in cache key construction that, under certain deployment configurations, allows an authenticated user to poison cached page content served to other users. Affected versions are from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE contains a server-side request forgery (SSRF) vulnerability caused by a time-of-check to time-of-use race condition in URL validation during repository import operations. An authenticated user could, under certain conditions, reach internal network resources.

The Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on data confidentiality, with no impact on integrity and availability.

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.

SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for.

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.