CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5226 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-5226
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI. Se ha descubierto un problema en GitLab que afecta a todas las versiones anteriores a 16.4.3, todas las versiones a partir de 16.5 anteriores a 16.5.3, todas las versiones a partir... • https://gitlab.com/gitlab-org/gitlab/-/issues/426400 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5963 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-5963
06 Nov 2023 — An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators. Se ha descubierto un problema en GitLab EE con Advanced Search que afecta a todas las versiones desde 13.9 a 16.3.6, 16.4 anterior a 16.4.2 y 16.5 anterior a 16.5.1 que podría permitir una denegación de servicio en la función de Advanced Search al enc... • https://gitlab.com/gitlab-org/gitlab/-/issues/423468 • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3909 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3909
06 Nov 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 12.3 anteriores a 16.3.6, todas las versiones desde 16.4 anteriores a 16.4.2, todas las versiones desde 16.5 anter... • https://gitlab.com/gitlab-org/gitlab/-/issues/418763 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3246 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-3246
06 Nov 2023 — An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. Se ha descubierto un problema en GitLab EE/CE que afecta a todas las versiones anteriores a 16.3.6, todas las versiones desde 16.4 anteriores a 16.4.2, todas las versiones desde 16.5 anteriores a 16.5.1, lo que permite a los atacantes bloquear el procesador de trabajos... • https://gitlab.com/gitlab-org/gitlab/-/issues/415371 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3922 – URL Redirection to Untrusted Site ('Open Redirect') in GitLab
https://notcve.org/view.php?id=CVE-2023-3922
29 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 8.15 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5, todas las versiones desde 16.4 anteriores a 16.4.1. Fue posible secuestrar alg... • https://gitlab.com/gitlab-org/gitlab/-/issues/394770 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5198 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5198
29 Sep 2023 — An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys. Se descubrió un problema en GitLab que afecta a todas las versiones anteriores a 16.2.7, todas las versiones desde 16.3 anteriores a 16.3.5 y todas las versiones desde 16.4 anteriores a 16.4.1. Era posible que un miembro eliminado del proye... • https://gitlab.com/gitlab-org/gitlab/-/issues/416957 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-0989 – Improper Ownership Management in GitLab
https://notcve.org/view.php?id=CVE-2023-0989
29 Sep 2023 — An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration. Un problema de divulgación de información en GitLab CE/EE que afecta a todas las versiones a partir de 13.11 anterior a 16.2.8, 16.3 anterior a 16.3.5 y 16.4 anterior a 16.4.1 permite a un atacante extraer variables CI/CD no... • https://gitlab.com/gitlab-org/gitlab/-/issues/417275 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-282: Improper Ownership Management •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-2233 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-2233
29 Sep 2023 — An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects. Se descubrió un problema de autorización incorrecta en GitLab CE/EE que afecta a todas las versiones desde 11.8 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5 y todas las versiones desde 16.... • https://gitlab.com/gitlab-org/gitlab/-/issues/408359 • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3115 – Incorrect User Management in GitLab
https://notcve.org/view.php?id=CVE-2023-3115
29 Sep 2023 — An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 11.11 anteriores a 16.2.8, 16.3 anteriores a 16.3.5 y 16.4 anteriores a 16.4.1. Las restricciones de Inicio de Sesión Único no se apli... • https://gitlab.com/gitlab-org/gitlab/-/issues/414367 • CWE-284: Improper Access Control CWE-286: Incorrect User Management •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3920 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3920
29 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 11.2 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5, todas las versiones desde 16.4 anteriores a ... • https://gitlab.com/gitlab-org/gitlab/-/issues/417481 • CWE-345: Insufficient Verification of Data Authenticity CWE-863: Incorrect Authorization •