{
        schema_version = "1.2.0";
        id = "f848ef90-1848-11ef-9850-001b217b3468";
        modified = "2024-05-22T00:00:00Z";
        published = "2024-05-22T00:00:00Z";
        summary = "Gitlab -- Vulnerabilities";
        details = <<EOD

	
	Gitlab reports:
	
	  1-click account takeover via XSS in the code editor in gitlab.com
	  A DOS vulnerability in the 'description' field of the runner
	  CSRF via K8s cluster-integration
	  Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipeline_id did not match
	  Redos on wiki render API/Page
	  Resource exhaustion and denial of service with test_report API calls
	  Guest user can view dependency lists of private projects through job artifacts
	  Stored XSS via PDFjs
	
	
    
    
EOD;
        references [
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4835";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-2874";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2023-7045";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2023-6502";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-1947";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4367";
            }
            {
                type = "WEB";
                url = "https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/";
            }
        ]
        affected [
            {
                package {
                    ecosystem = "FreeBSD:ports";
                    name = "gitlab-ce";
                }
                ranges [
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "17.0.0";
                            }
                            {
                                fixed = "17.0.1";
                            }
                        ]
                    }
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "16.11.0";
                            }
                            {
                                fixed = "16.11.3";
                            }
                        ]
                    }
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "11.11";
                            }
                            {
                                fixed = "16.10.6";
                            }
                        ]
                    }
                ]
            }
            {
                package {
                    ecosystem = "FreeBSD:ports";
                    name = "gitlab-ee";
                }
                ranges [
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "17.0.0";
                            }
                            {
                                fixed = "17.0.1";
                            }
                        ]
                    }
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "16.11.0";
                            }
                            {
                                fixed = "16.11.3";
                            }
                        ]
                    }
                    {
                        type = "SEMVER";
                        events [
                            {
                                introduced = "11.11";
                            }
                            {
                                fixed = "16.10.6";
                            }
                        ]
                    }
                ]
            }
        ]
        database_specific {
            discovery = "2024-05-22T00:00:00Z";
        }
    }
    {
        schema_version = "1.2.0";
        id = "8247af0d-183b-11ef-9f97-a8a1599412c6";
        modified = "2024-05-22T00:00:00Z";
        published = "2024-05-22T00:00:00Z";
        summary = "chromium -- multiple security fixes";
        details = <<EOD

      
       Chrome Releases reports:
       
	 This update includes 15 security fixes:
	 
	    [336012573] High CVE-2024-5157: Use after free in Scheduling. Reported by Looben Yang on 2024-04-21
	    [338908243] High CVE-2024-5158: Type Confusion in V8. Reported by Zhenghang Xiao (@Kipreyyy) on 2024-05-06
	    [335613092] High CVE-2024-5159: Heap buffer overflow in ANGLE. Reported by David Sievers (@loknop) on 2024-04-18
	    [338161969] High CVE-2024-5160: Heap buffer overflow in Dawn. Reported by wgslfuzz on 2024-05-01
	    [340221135] High CVE-2024-4947: Type Confusion in V8. Reported by Vasily Berdnikov (@vaber_b) and Boris Larin (@oct0xor) of Kaspersky on 2024-05-13
	    [333414294] High CVE-2024-4948: Use after free in Dawn. Reported by wgslfuzz on 2024-04-09
	    [326607001] Medium CVE-2024-4949: Use after free in V8. Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team on 2024-02-24
	    [40065403] Low CVE-2024-4950: Inappropriate implementation in Downloads. Reported by Shaheen Fazim on 2023-06-06
	 
       
      
    
    
EOD;
        references [
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-5157";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-5158";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-5159";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-5160";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4947";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4948";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4949";
            }
            {
                type = "ADVISORY";
                url = "https://api.osv.dev/v1/vulns/CVE-2024-4950";
            }
            {
                type = "WEB";
                url = "https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html";
            }
        ]
        affected [
            {
                package {
                    ecosystem = "FreeBSD:ports";
                    name = "chromium";
                }
                ranges [
                    {
                        type = "SEMVER";
                        events [
                            {
                                fixed = "125.0.6422.76";
                            }
                            {
                                introduced = "0";
                            }
                        ]
                    }
                ]
            }
            {
                package {
                    ecosystem = "FreeBSD:ports";
                    name = "ungoogled-chromium";
                }
                ranges [
                    {
                        type = "SEMVER";
                        events [
                            {
                                fixed = "125.0.6422.76";
                            }
                            {
                                introduced = "0";
                            }
                        ]
                    }
                ]
            }
        ]
        database_specific {
            discovery = "2024-05-21T00:00:00Z";
        }
    }