CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0425
https://notcve.org/view.php?id=CVE-2022-0425
01 Apr 2022 — A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks. Una vulnerabilidad de reenganche de DNS en la integración de Irker IRC Gateway en todas las versiones de GitLab CE/EE desde la versión 7.9, permite a un atacante desencadenar ataques de tipo Server Side Request Forgery (SSRF) • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0425.json • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39908
https://notcve.org/view.php?id=CVE-2021-39908
01 Apr 2022 — In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI. En todas las versiones de GitLab CE/EE a partir de la 0.8.0 antes de la 14.2.6, en todas las versiones a partir de la 14.3 antes de la 14.3.4, y en todas las versiones a partir de la 14.4 antes de la 14.... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39908.json • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0123
https://notcve.org/view.php?id=CVE-2022-0123
28 Mar 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services. Se ha detectado un problema afectando las versiones de GitLab anteriores a 14.4.5, entre la 14.5.0 y la 14.5.3, y entre la 14.6.0 y la 14.6.1. GitLab no comprueba los certificados SSL para algunos de los servicios ex... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0090
https://notcve.org/view.php?id=CVE-2022-0090
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI. Se ha detectado un problema que afecta a versiones de GitLab anteriores a la 14.4.5, entre la 14.5.0 y la 14.5.3, y entre la 14.6.0 y la 14.6.1. GitLab está configurado de forma que no ignora las referencias... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0090.json • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0093
https://notcve.org/view.php?id=CVE-2022-0093
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds. Se ha detectado un problema que afecta a versiones de GitLab anteriores a 14.4.5, entre 14.5.0 y 14.5.3, y entre 14.6.0 y 14.6.1. GitLab permite que un usuario con una contraseña caducada acceda a información confidencial mediante canales RSS • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0093.json •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0154
https://notcve.org/view.php?id=CVE-2022-0154
18 Jan 2022 — An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de la 7.7 anteriores a 14.4.5, a todas las versiones a partir de la 14.5.0 ante... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0124
https://notcve.org/view.php?id=CVE-2022-0124
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack. Se ha detectado un problema que afecta a las versiones de GitLab anteriores a 14.4.5, entre 14.5.0 y 14.5.3, y entre 14.6.0 y 14.6.1. La integración de Gitlab con Slack comprueba incorrectamente las entradas de los usuarios y permite que se diseñen URLs malic... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.json • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39937
https://notcve.org/view.php?id=CVE-2021-39937
13 Dec 2021 — A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances Una colisión en la lógica de memorización de acceso en todas las versiones de GitLab CE/EE anteriores a 14.3.6, todas las versiones a partir de 14.4 anteriores a 14.4.4, todas las versiones a partir de 14.5 anteriores a 14.5.2, conlleva a poten... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39937.json • CWE-269: Improper Privilege Management •
CVSS: 6.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39895
https://notcve.org/view.php?id=CVE-2021-39895
04 Nov 2021 — In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source. En todas las versiones de GitLab CE/EE desde versión 8.0, un atacante puede configurar las programaciones de tuberías para que estén activas en una exportación d... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39895.json •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39913
https://notcve.org/view.php?id=CVE-2021-39913
04 Nov 2021 — Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges El registro accidental de la contraseña de root del sistema en el registro de migración en todas las versiones de GitLab CE/EE anteriores a la 14.2.6, en todas las versiones a partir de la 14.3 antes de la 14.3.4 y e... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39913.json • CWE-532: Insertion of Sensitive Information into Log File •