Page 21 of 291 results (0.006 seconds)

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-2022 – Missing Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-2022

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge • https://gitlab.com/gitlab-org/gitlab/-/issues/407166 • CWE-262: Not Using Password Aging CWE-284: Improper Access Control •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2023-3401 – Improper Control of Generation of Code ('Code Injection') in GitLab

https://notcve.org/view.php?id=CVE-2023-3401

02 Aug 2023 — An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code. • https://gitlab.com/gitlab-org/gitlab/-/issues/416252 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-4011 – Allocation of Resources Without Limits or Throttling in GitLab

https://notcve.org/view.php?id=CVE-2023-4011

02 Aug 2023 — An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS. • https://gitlab.com/gitlab-org/gitlab/-/issues/409367 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3500 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2023-3500

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 10.0 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de l... • https://gitlab.com/gitlab-org/gitlab/-/issues/416902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1

CVE-2023-3900 – Improper Validation of Specified Type of Input in GitLab

https://notcve.org/view.php?id=CVE-2023-3900

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de 16.1 antes de 16.1.3, todas las versiones a partir de 16.2 antes de 16.2.2. Un valor no válido de 'start_sha' en la página de solicitudes de fusión puede provo... • https://gitlab.com/gitlab-org/gitlab/-/issues/418770 • CWE-20: Improper Input Validation CWE-1287: Improper Validation of Specified Type of Input •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-3993 – Insertion of Sensitive Information into Log File in GitLab

https://notcve.org/view.php?id=CVE-2023-3993

02 Aug 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones a partir de la 14.3 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.1.3, a todas las versiones a partir de la 16.2 antes de la 16.2.2... • https://gitlab.com/gitlab-org/gitlab/-/issues/409570 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3994 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-3994

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la... • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-0632 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-0632

01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 15.2 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 ante... • https://gitlab.com/gitlab-org/gitlab/-/issues/390148 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1

CVE-2023-1210 – Generation of Error Message Containing Sensitive Information in GitLab

https://notcve.org/view.php?id=CVE-2023-1210

01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 12.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 1... • https://gitlab.com/gitlab-org/gitlab/-/issues/394775 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-2164 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2023-2164

01 Aug 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 15.9 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones... • https://gitlab.com/gitlab-org/gitlab/-/issues/407783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •