CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1406
https://notcve.org/view.php?id=CVE-2022-1406
11 May 2022 — Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project Una comprobación de entrada inapropiada en GitLab CE/EE afectando a todas las versiones desde la 8.12 anteriores a 14.8.6, todas las versiones desde la 14.9.0 anteriores a 14.9.4 y 14.10.0, permite a un desarrollador leer variables de CI/CD protegidas de grupos o... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1428
https://notcve.org/view.php?id=CVE-2022-1428
11 May 2022 — An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced. Se ha detectado un problema en GitLab afectando a todas las versiones anteriores a 14.8.6, a todas las versiones a partir de la 14.9 anteriores a 14.9.4 y todas las versiones a partir de la 14.10 anteriores a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1352
https://notcve.org/view.php?id=CVE-2022-1352
11 May 2022 — Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members. Debido a una vulnerabilidad de referencia directa a objetos insegura en Gitlab EE/CE afectando a todas las versiones desde 11.0 anteriores a 14.8.6, 14.9 anteriore... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1352.json • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1417
https://notcve.org/view.php?id=CVE-2022-1417
10 May 2022 — Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs Un control de acceso inadecuado en GitLab CE/EE que afecta a todas las versiones a partir de la 8.12 antes de la 14.8.6, a todas las versiones a partir de la 14.9 antes de la 14.9.4, y a todas las versiones a partir de... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1417.json • CWE-863: Incorrect Authorization •
CVSS: 3.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1157
https://notcve.org/view.php?id=CVE-2022-1157
11 Apr 2022 — Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged Una falta de saneo de los mensajes de excepción registrados en todas las versiones anteriores a 14.7.7, 14.8 anteriores a 14.8.5 y 14.9 anteriores a 14.9.2 de GitLab CE/EE causa el registro de posibles valores confidenciales en URLs no válidas • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1157.json • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2022-1193
https://notcve.org/view.php?id=CVE-2022-1193
11 Apr 2022 — Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances Un control de acceso inadecuado en las versiones 10.7 anterior a 14.7.7, 14.8 anterior a 14.8.5 y 14.9 anterior a 14.9.2 de GitLab CE/EE permite a un actor malintencionado obtener detalles del último commit de un proyecto privado a través de Merge Requests en de... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1193.json • CWE-863: Incorrect Authorization •
CVSS: 8.7EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1190
https://notcve.org/view.php?id=CVE-2022-1190
04 Apr 2022 — Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. Un manejo inapropiado de la entrada del usuario en GitLab CE/EE versiones 8.3 anteriores a 14.7.7, 14.8 anteriores a 14.8.5 y 14.9 anteriores a 14.9.2, permitía a un atacante explotar un ataque de tipo XSS almacenado al abusar de las referencias de hitos de vari... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1121
https://notcve.org/view.php?id=CVE-2022-1121
04 Apr 2022 — A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption. Una falta de tiempos de espera apropiados en GitLab Pages incluidos en GitLab CE/EE todas las versiones anteriores a 14.7.7, 14.8 anteriores a 14.8.5 y 14.9 anteriores a 14.9.2, permite a un atacante causar un consumo no limitado de recursos • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1121.json • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1185
https://notcve.org/view.php?id=CVE-2022-1185
04 Apr 2022 — A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file Una vulnerabilidad de denegación de servicio cuando son renderizados archivos RDoc en GitLab CE/EE versiones 10 a 14.7.7, 14.8.0 a 14.8.5 y 14.9.0 a 14.9.2, permite a un atacante bloquear la aplicación web de GitLab con un archivo RDoc maliciosamente diseñado • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1185.json • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-1120
https://notcve.org/view.php?id=CVE-2022-1120
04 Apr 2022 — Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration. Una falta de filtrado en un mensaje de error en GitLab CE/EE afectando a todas las versiones anteriores a 14.7.7, 14.8 anteriores a 14.8.5 y 14.9 anteriores a 14.9.2, expone información confidencial cuando falla una directiva de inclusión en la configuración de CI/CD • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1120.json • CWE-209: Generation of Error Message Containing Sensitive Information •