CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3486
https://notcve.org/view.php?id=CVE-2022-3486
09 Nov 2022 — An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. Una vulnerabilidad de redireccionamiento abierto en GitLab EE/CE que afecta a todas las versiones desde la 9.3 anterior a la 15.3.5, la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2, permite a un atacante redirigir a los usuarios a una ubicación arbitraria si confían en l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3018
https://notcve.org/view.php?id=CVE-2022-3018
28 Oct 2022 — An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs. Una vulnerabilidad de divulgación de información en GitLab CE/EE que afecta a todas las versiones desde 9.3 anteriores a 15.2.5, todas las versiones desde 15.3 anteriores a 15.3.4, todas las versiones desde 15.4 anteri... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3018.json • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2826
https://notcve.org/view.php?id=CVE-2022-2826
28 Oct 2022 — An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. TODO Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 10.0 anteriores a 12.9.8, todas las versiones desde 12.10 anteriores a 12.10.7, todas las versiones desde 13.0 anteriores a 13.0.1. TODO • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2826.json •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3639
https://notcve.org/view.php?id=CVE-2022-3639
21 Oct 2022 — A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage. Se ha detectado una potencial vulnerabilidad de DOS en GitLab CE/EE que afecta a todas las versiones desde la 10.8 anteriores a 15.1.6, a todas las versiones desde la 15.2 anteriores a 15.2.4, a todas las versiones desd... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3639.json • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.9EPSS: 34%CPEs: 6EXPL: 2CVE-2022-2992 – GitLab GitHub Repo Import Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-2992
17 Oct 2022 — A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. Una vulnerabilidad en GitLab CE/EE afectando a todas las versiones desde la 11.10 anteriores a 15.1.6, desde la 15.2 hasta la 15.2.4, desde la 15.3 hasta la 15.3.2 permite a un usuario autenticado lograr la ejecución de código remota por medio del endpoint de la API Import from GitHub An authen... • https://github.com/CsEnox/CVE-2022-2992 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3030
https://notcve.org/view.php?id=CVE-2022-3030
17 Oct 2022 — An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users. Un problema de control de acceso inapropiado en GitLab CE/EE afectando a todas las versiones a partir de 15.1.6, a todas las versiones a partir de 15.2 anteriores a 15.2.4, a todas las versiones a partir de 15.3 anteriores a 15.3.2 permite revelar el estado de las tuberías a usuar... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3030.json •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3031
https://notcve.org/view.php?id=CVE-2022-3031
17 Oct 2022 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones anteriores a 15.1.6, a todas las versiones a partir de 15.2 anteriores a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3031.json •
CVSS: 7.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2865
https://notcve.org/view.php?id=CVE-2022-2865
17 Oct 2022 — A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Se ha detectado un problema de tipo cross-site scripting en GitLab CE/EE afectando a todas las versiones anteriores a 15.1.6, 15.2 a 15.2.4 y 15.3 anteriores a 15.3.2... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 1%CPEs: 6EXPL: 2CVE-2022-2884 – GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)
https://notcve.org/view.php?id=CVE-2022-2884
17 Oct 2022 — A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint Una vulnerabilidad en GitLab CE/EE afectando a todas las versiones desde la 11.3.4 anteriores a 15.1.5, desde la 15.2 a 15.2.3, desde la 15.3 a 15.3.1, permite a un usuario autenticado lograr una ejecución de código remota por medio del endpoint de la API Import from GitHub GitLab ve... • https://www.exploit-db.com/exploits/51181 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2908
https://notcve.org/view.php?id=CVE-2022-2908
17 Oct 2022 — A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field. Se ha detectado una potencial vulnerabilidad DoS en Gitlab CE/EE versiones a partir de 10.7 anteriores a 15.1.5, todas las versiones a partir de 15.2 anteriores a 15.2.3, todas las versiones a partir de 15.... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2908.json • CWE-1333: Inefficient Regular Expression Complexity •