CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3907 – Improper User Management in GitLab
https://notcve.org/view.php?id=CVE-2023-3907
17 Dec 2023 — A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner Una vulnerabilidad de escalada de privilegios en GitLab EE que afecta a todas las versiones desde 16.0 anterior a 16.4.4, 16.5 anterior a 16.5.4 y 16.6 anterior a 16.6.2 permite que un mantenedor de proyecto use un token de acceso al proyecto para escalar su rol a propietari... • https://gitlab.com/gitlab-org/gitlab/-/issues/418878 • CWE-269: Improper Privilege Management CWE-286: Incorrect User Management •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3904 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3904
15 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido... • https://gitlab.com/gitlab-org/gitlab/-/issues/418226 • CWE-284: Improper Access Control CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5061 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5061
15 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 9.3 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.... • https://gitlab.com/gitlab-org/gitlab/-/issues/425521 • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5512 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-5512
15 Dec 2023 — An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 16.3 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 ant... • https://gitlab.com/gitlab-org/gitlab/-/issues/427827 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-6051 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-6051
15 Dec 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones desde 15.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2. La integridad del archivo pu... • https://gitlab.com/gitlab-org/gitlab/-/issues/431345 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-6680 – Improper Certificate Validation in GitLab
https://notcve.org/view.php?id=CVE-2023-6680
15 Dec 2023 — An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator. Un problema de validación de certificado incorrecto en la autenticación de tarjeta inteligente en GitLab EE que afect... • https://gitlab.com/gitlab-org/gitlab/-/issues/421607 • CWE-295: Improper Certificate Validation •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3511 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3511
15 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 8.17 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2.... • https://gitlab.com/gitlab-org/gitlab/-/issues/416961 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 7EXPL: 1CVE-2023-5332 – Dependency on Vulnerable Third-Party Component in GitLab
https://notcve.org/view.php?id=CVE-2023-5332
04 Dec 2023 — Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE. El parche en la librería de terceros Consul requiere que 'enable-script-checks' esté configurado en False. • https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8171 • CWE-16: Configuration CWE-1395: Dependency on Vulnerable Third-Party Component •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3443 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3443
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 12.1 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 16.6 anteriores a 16.6.1. Un usuario invitado podía agregar un... • https://gitlab.com/gitlab-org/gitlab/-/issues/416497 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3964 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3964
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 13.2 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 16.6 ... • https://gitlab.com/gitlab-org/gitlab/-/issues/419857 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •