CVE-2024-0402

CRITICAL Year: 2024
CVSS v3 Score
9.9
Critical
Weakness Type
CWE-22
View all →

Vulnerability Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

Related Vulnerabilities

CVE-2018-16367

CRITICAL
CVSS:9.9(Critical)

In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user can write a directory listing to /tmp, and can leak file data with a #include.

CWE-222018

CVE-2018-18809

CRITICAL
CVSS:9.9(Critical)

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperRep...

CWE-222018

CVE-2018-19586

CRITICAL
CVSS:9.9(Critical)

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a St...

CWE-222018

CVE-2019-11510

CRITICAL
CVSS:9.9(Critical)

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary ...

CWE-222019

CVE-2019-13343

CRITICAL
CVSS:9.9(Critical)

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers ...

CWE-222019

CVE-2020-6142

CRITICAL
CVSS:9.9(Critical)

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP reques...

CWE-222020