Page 23 of 295 results (0.007 seconds)

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2023-3362 – Generation of Error Message Containing Sensitive Information in GitLab

https://notcve.org/view.php?id=CVE-2023-3362

13 Jul 2023 — An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub. • https://gitlab.com/gitlab-org/gitlab/-/issues/415131 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information CWE-287: Improper Authentication •

CVSS: 3.9EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-3363 – Insertion of Sensitive Information into Log File in GitLab

https://notcve.org/view.php?id=CVE-2023-3363

13 Jul 2023 — An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`. • https://gitlab.com/gitlab-org/gitlab/-/issues/409034 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3444 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-3444

13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches. • https://gitlab.com/gitlab-org/gitlab/-/issues/406803 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-863: Incorrect Authorization •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3424 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-3424

13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/gitlab/-/issues/409802 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-2200 – Improper Encoding or Escaping of Output in GitLab

https://notcve.org/view.php?id=CVE-2023-2200

13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field. • https://gitlab.com/gitlab-org/gitlab/-/issues/408281 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-116: Improper Encoding or Escaping of Output •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-2190 – Authorization Bypass Through User-Controlled Key in GitLab

https://notcve.org/view.php?id=CVE-2023-2190

13 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public. • https://gitlab.com/gitlab-org/gitlab/-/issues/408137 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-1936 – Exposure of Private Personal Information to an Unauthorized Actor in GitLab

https://notcve.org/view.php?id=CVE-2023-1936

11 Jul 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue. • https://gitlab.com/gitlab-org/gitlab/-/issues/405150 • CWE-284: Improper Access Control CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

CVE-2022-4143

https://notcve.org/view.php?id=CVE-2022-4143

28 Jun 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4143.json • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2023-2232

https://notcve.org/view.php?id=CVE-2023-2232

28 Jun 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2232.json • CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-0121 – Allocation of Resources Without Limits or Throttling in GitLab

https://notcve.org/view.php?id=CVE-2023-0121

07 Jun 2023 — A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •