CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3917 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3917
29 Sep 2023 — Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail. La Denegación de Servicio en pipelines afectan a todas las versiones de Gitlab EE y CE anteriores a 16.2.8, 16.3 anterior a 16.3.5 y 16.4 anterior a 16.4.1 permite que un atacante provoque fallas en los pipelines. • https://gitlab.com/gitlab-org/gitlab/-/issues/417896 • CWE-20: Improper Input Validation CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3914 – Incorrect User Management in GitLab
https://notcve.org/view.php?id=CVE-2023-3914
29 Sep 2023 — A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects. Un error de lógica de negocios en GitLab EE que afecta a todas las versiones anteriores a 16.2.8, 16.3 anterior a 16.3.5 y 16.4 anterior a 16.4.1 permite el acceso a proyectos internos. Una cuenta de servicio no se elimina cuando se elimina un espacio d... • https://gitlab.com/gitlab-org/gitlab/-/issues/418115 • CWE-286: Incorrect User Management CWE-840: Business Logic Errors •
CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3906 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3906
29 Sep 2023 — An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy. Un problema de validación de entrada en el proxy de activos en GitLab EE, que afectó a todas las versiones desde 12.3 anterior a 16.2.8, 16.3 anterior a 16.3.5 y 16.4 anterior a 16.4.1, permitió a un atacante autenticado crear URL de imágenes que omitían el activo apoder... • https://gitlab.com/gitlab-org/gitlab/-/issues/419213 • CWE-20: Improper Input Validation CWE-1287: Improper Validation of Specified Type of Input CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3979 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3979
29 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 10.6 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5, todas las versiones desde ... • https://gitlab.com/gitlab-org/gitlab/-/issues/419972 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-4532 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-4532
29 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 16.2 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5, todas las versiones desde 16.4 anteriores a 16.4.1. Los usuarios pudiero... • https://gitlab.com/gitlab-org/gitlab/-/issues/423357 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-5009 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5009
19 Sep 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones a partir de 13.12 antes de 16.2.7, todas las versio... • https://gitlab.com/gitlab-org/gitlab/-/issues/425304 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-4630 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-4630
11 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 10.6 anteriores a 16.1.5, todas las versiones desde 16.2 anteriores a 16.2.5, todas las versiones desde 16.3 anteriores a 16.3.1 en el que cualquier usuario puede leer ... • https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3210 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3210
01 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 15.11 antes de la 16.1.5, a todas las versiones a partir de la 16.2 antes de la 16.2.5 y a todas las versiones a partir de la 16.3 a... • https://gitlab.com/gitlab-org/gitlab/-/issues/415074 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-3950 – Cleartext Storage of Sensitive Information in GitLab
https://notcve.org/view.php?id=CVE-2023-3950
01 Sep 2023 — An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it. Un problema de divulgación de información en GitLab EE que afectaba a todas las versiones desde la 16.2 hasta la 16.2.5, y desde la 16.3 hasta la 16.3.1 permitía a otros propietarios de grupo ver la clave pública de un... • https://gitlab.com/gitlab-org/gitlab/-/issues/419675 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 1CVE-2023-4018 – Direct Request ('Forced Browsing') in GitLab
https://notcve.org/view.php?id=CVE-2023-4018
01 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. • https://gitlab.com/gitlab-org/gitlab/-/issues/420301 • CWE-284: Improper Access Control CWE-425: Direct Request ('Forced Browsing') •