CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3500 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2023-3500
02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 10.0 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de l... • https://gitlab.com/gitlab-org/gitlab/-/issues/416902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3994 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3994
02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la... • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2023-1210 – Generation of Error Message Containing Sensitive Information in GitLab
https://notcve.org/view.php?id=CVE-2023-1210
01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 12.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 1... • https://gitlab.com/gitlab-org/gitlab/-/issues/394775 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.8EPSS: 6%CPEs: 6EXPL: 1CVE-2023-3364 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3364
01 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 8.14 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.... • https://gitlab.com/gitlab-org/gitlab/-/issues/415995 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3385 – Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
https://notcve.org/view.php?id=CVE-2023-3385
01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html). Se ha descubierto un problema en GitLab que afecta ... • https://gitlab.com/gitlab-org/gitlab/-/issues/416161 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-1401 – Insertion of Sensitive Information Into Sent Data in GitLab
https://notcve.org/view.php?id=CVE-2023-1401
26 Jul 2023 — An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization. • https://gitlab.com/gitlab-org/gitlab/-/issues/396533 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-201: Insertion of Sensitive Information Into Sent Data CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3484 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3484
21 Jul 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations. • https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released • CWE-840: Business Logic Errors CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-2576 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-2576
13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch. • https://gitlab.com/gitlab-org/gitlab/-/issues/410123 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 3.9EPSS: 0%CPEs: 6EXPL: 0CVE-2023-3363 – Insertion of Sensitive Information into Log File in GitLab
https://notcve.org/view.php?id=CVE-2023-3363
13 Jul 2023 — An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`. • https://gitlab.com/gitlab-org/gitlab/-/issues/409034 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3424 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3424
13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/gitlab/-/issues/409802 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •