{"vulnerability": "CVE-2024-12379", "sightings": [{"uuid": "66e2b651-2ce2-4d15-8127-e070201f38b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12379", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhyhqfusmi2p", "content": "", "creation_timestamp": "2025-02-12T15:16:26.149440Z"}, {"uuid": "d84fa986-22a6-4585-857b-4f2298f1e595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12379", "type": "seen", "source": "https://t.me/cvedetector/17903", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-12379 - GitLab Denial of Service (DoS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-12379 \nPublished : Feb. 12, 2025, 3:15 p.m. | 1\u00a0hour, 46\u00a0minutes ago \nDescription : A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-12T18:33:45.000000Z"}, {"uuid": "9a1d1721-d724-4005-93bf-7598e061d77f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12379", "type": "seen", "source": "https://t.me/poxek/6361", "content": "\u0421\u043e\u0431\u0440\u0430\u043b GitLab \u0432\u0438\u0434\u0435\u043e PoC's  \ud83d\udd0d\n\n\u041f\u0440\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 CVE \u043f\u043e\u0434 GitLab \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 PoC \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437 \u043d\u0438\u0445. \u0417\u0430\u043b\u0438\u043b \u0442\u0430\u043a\u0438\u0435 \u043a\u0435\u0439\u0441\u044b \u043a \u0441\u0435\u0431\u0435 \u043d\u0430 YouTube, \u0432\u0434\u0440\u0443\u0433 \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0436\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u0441\u044f. \n\n\u0418\u0418\u0448\u043a\u0438 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u0441\u0442\u0430\u0442\u0438, \u0432\u043e\u043e\u0431\u0449\u0435 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u0438 CVE \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e proof of concept. \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f)\n\nRCE / command injection\n\u27a1\ufe0f CVE-2022-0751 - \u041d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u0430\u044f \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Gitlab.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0436\u0435\u0440\u0442\u0432\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\u27a1\ufe0f CVE-2023-1708 - \u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\n\u27a1\ufe0f CVE-2024-8402 - Maintainer \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e Google integration, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438.\n\u27a1\ufe0f CVE-2024-9773 - shell injection \u0447\u0435\u0440\u0435\u0437 Harbor project name / helper scripts\n\u27a1\ufe0f CVE-2024-8640 - Reverse shell with root access to analytics Cube instance\n\nSSRF\n\u27a1\ufe0f CVE-2024-9870 - Full SSRF \u0447\u0435\u0440\u0435\u0437 Workspaces\n\u27a1\ufe0f CVE-2022-4335 - Blind SSRF \u043d\u0430 repository mirroring (DNS rebinding)\n\u27a1\ufe0f CVE-2021-22179 - SSRF \u0432 webhook / outbound requests\n\u27a1\ufe0fCVE-2025-6454 - CRLF Injection in Webhook custom header could lead to blind SSRF\n\u27a1\ufe0fCVE-2024-8977 - Full read SSRF\n\nXSS\n\u27a1\ufe0f CVE-2024-8312 - Stored XSS with CSP bypass\n\u27a1\ufe0f CVE-2025-7734 - Stored XSS in blob viewer\n\nDoS\n\u27a1\ufe0f CVE-2026-1456 - DoS \u0447\u0435\u0440\u0435\u0437 tasks / GraphQL-ish \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443\n\u27a1\ufe0f CVE-2026-1458 - DoS + path traversal \u0432 \u0442\u043e\u043c \u0436\u0435 \u0434\u0443\u0445\u0435\n\u27a1\ufe0f CVE-2024-8177 - Harbor DoS\n\u27a1\ufe0f CVE-2024-12379 - \u0441\u0435\u0440\u0438\u044f screen recordings \u043f\u043e\u0434 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439\n\n\u041f\u0440\u043e\u0447\u0435\u0435\n\u27a1\ufe0f CVE-2026-1230 - \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u043c\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438\n\u27a1\ufe0f CVE-2024-6502 - \u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 GitLab \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u0437 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.\n\u27a1\ufe0f CVE-2024-8970 - Account takeover\n\u27a1\ufe0f CVE-2021-22203 - Arbitrary file read\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-10-07T09:16:13.000000Z"}]}