CVE-2024-6595

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-65969.8An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.CVE-2024-65986.5A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticatCVE-2024-65994.3The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajaCVE-2024-66006.3Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 819CVE-2024-66014.7A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < CVE-2024-66029.8A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 11CVE-2024-66037.4In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruptionCVE-2024-66047.5Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruptiCVE-2024-66058.8Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects FirefoxCVE-2024-66068.2Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects FirefoCVE-2024-66078.8It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `&lt;seleCVE-2024-66084.3It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox
CVE-2024-6595: Medium severity, CVSS 5.3 | Vulnix