CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2227
https://notcve.org/view.php?id=CVE-2022-2227
01 Jul 2022 — Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions Un control de acceso inapropiado en la API de trabajos del corredor en GitLab CE/EE afectando a todas las versiones anteriores a 14.10.5, 15.0 anteriores a 15.0.4, y 15.1 anteriores a 15.1.1, permite a un mantenedor anterior de un proy... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2227.json • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1423
https://notcve.org/view.php?id=CVE-2022-1423
19 May 2022 — Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches Un control de acceso inapropiado en el mecanismo de caché CI/CD en GitLab CE/EE afectando a todas las versiones a partir de la 1.0.2 anteriores a 14.8.6, todas las ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1423.json • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1413
https://notcve.org/view.php?id=CVE-2022-1413
19 May 2022 — Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface Una falta de enmascaramiento de entradas en GitLab CE/EE, afectando a todas las versiones a partir de la 1.0.2 anteriores a 14.8.6, todas las versiones a partir de la 14.9.0 anteriores a 14.9.4 y todas las versiones a partir de la 14.10.0 ant... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1413.json • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 1CVE-2022-1416
https://notcve.org/view.php?id=CVE-2022-1416
19 May 2022 — Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling Una falta de saneo de datos en los mensajes de error de Pipeline en GitLab CE/EE, afectando a todas las versiones a partir de la 1.0.2 anteriores a 14.8.6, todas las versiones a partir de la 14.9.0 anteriores a 14.9.4 y todas l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1124
https://notcve.org/view.php?id=CVE-2022-1124
11 May 2022 — An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled Se ha detectado un problema de autorización incorrecta en GitLab CE/EE afectando a todas las versiones anteriores a 14.8.6, todas las versiones de la 14.9.0 anteriores a 14.9.4 y 14.10.0, y que permite a miembros del proyecto invitados acceder al registro de seguimiento ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1124.json • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1460
https://notcve.org/view.php?id=CVE-2022-1460
11 May 2022 — An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user. Se ha detectado un problema en GitLab afectando a todas las versiones a partir de la 9.2 anteriores a 14.8.6, todas las versiones a partir de la 14.9 anteriores a 14.9.4, to... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1460.json • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1406
https://notcve.org/view.php?id=CVE-2022-1406
11 May 2022 — Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project Una comprobación de entrada inapropiada en GitLab CE/EE afectando a todas las versiones desde la 8.12 anteriores a 14.8.6, todas las versiones desde la 14.9.0 anteriores a 14.9.4 y 14.10.0, permite a un desarrollador leer variables de CI/CD protegidas de grupos o... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1428
https://notcve.org/view.php?id=CVE-2022-1428
11 May 2022 — An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced. Se ha detectado un problema en GitLab afectando a todas las versiones anteriores a 14.8.6, a todas las versiones a partir de la 14.9 anteriores a 14.9.4 y todas las versiones a partir de la 14.10 anteriores a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1417
https://notcve.org/view.php?id=CVE-2022-1417
10 May 2022 — Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs Un control de acceso inadecuado en GitLab CE/EE que afecta a todas las versiones a partir de la 8.12 antes de la 14.8.6, a todas las versiones a partir de la 14.9 antes de la 14.9.4, y a todas las versiones a partir de... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1417.json • CWE-863: Incorrect Authorization •
CVSS: 3.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1157
https://notcve.org/view.php?id=CVE-2022-1157
11 Apr 2022 — Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged Una falta de saneo de los mensajes de excepción registrados en todas las versiones anteriores a 14.7.7, 14.8 anteriores a 14.8.5 y 14.9 anteriores a 14.9.2 de GitLab CE/EE causa el registro de posibles valores confidenciales en URLs no válidas • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1157.json • CWE-532: Insertion of Sensitive Information into Log File •