CVSS: 5.7EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0489
https://notcve.org/view.php?id=CVE-2022-0489
01 Apr 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de la 8.15 . Era posible desencadenar un DOS usando la función de matemáticas con una fórmula específica en los comentarios de la edición • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0489.json • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0136
https://notcve.org/view.php?id=CVE-2022-0136
28 Mar 2022 — A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. Se ha detectado una vulnerabilidad en GitLab versiones 10.5 a 14.5.4, 14.6 a 14.6.4 y 14.7 a 14.7.1. GitLab era vulnerable a un ataque de tipo SSRF ciego mediante la funcionalidad Project Import • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.json • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0488
https://notcve.org/view.php?id=CVE-2022-0488
28 Mar 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de la 8.10. Era posible desencadenar un tiempo de espera en una página con markdown al usar una cantidad específica de comillas de bloque • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0488.json • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2022-0344
https://notcve.org/view.php?id=CVE-2022-0344
28 Mar 2022 — An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project Se ha detectado un problema en GitLab afectando a todas las versiones a partir de la 10.0 anteriores a 14.5.4, todas las versiones a partir de la 10.1 anteriores a ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0344.json •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0123
https://notcve.org/view.php?id=CVE-2022-0123
28 Mar 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services. Se ha detectado un problema afectando las versiones de GitLab anteriores a 14.4.5, entre la 14.5.0 y la 14.5.3, y entre la 14.6.0 y la 14.6.1. GitLab no comprueba los certificados SSL para algunos de los servicios ex... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0738
https://notcve.org/view.php?id=CVE-2022-0738
28 Mar 2022 — An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions. Se ha detectado un problema en GitLab afectando a todas las versiones a partir de la 14.6 anteriores a 14.6.5, todas las versiones a partir de la 14.7 anteriores a 14.7.4, todas las versiones a partir de la 14.8 anterior... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0738.json • CWE-522: Insufficiently Protected Credentials •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0751
https://notcve.org/view.php?id=CVE-2022-0751
28 Mar 2022 — Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands Una visualización imprecisa de los archivos Snippet que contienen caracteres especiales en todas las versiones de GitLab CE/EE permite a un atacante crear Snippets con contenido engañoso que podría engañar a usuarios desprevenidos para que ejecuten comandos arbitrario • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0751.json •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0090
https://notcve.org/view.php?id=CVE-2022-0090
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI. Se ha detectado un problema que afecta a versiones de GitLab anteriores a la 14.4.5, entre la 14.5.0 y la 14.5.3, y entre la 14.6.0 y la 14.6.1. GitLab está configurado de forma que no ignora las referencias... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0090.json • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0093
https://notcve.org/view.php?id=CVE-2022-0093
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds. Se ha detectado un problema que afecta a versiones de GitLab anteriores a 14.4.5, entre 14.5.0 y 14.5.3, y entre 14.6.0 y 14.6.1. GitLab permite que un usuario con una contraseña caducada acceda a información confidencial mediante canales RSS • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0093.json •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0154
https://notcve.org/view.php?id=CVE-2022-0154
18 Jan 2022 — An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de la 7.7 anteriores a 14.4.5, a todas las versiones a partir de la 14.5.0 ante... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json • CWE-352: Cross-Site Request Forgery (CSRF) •