CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0121
https://notcve.org/view.php?id=CVE-2023-0121
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json https://gitlab.com/gitlab-org/gitlab/-/issues/387549 https://hackerone.com/reports/1774688 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0508
https://notcve.org/view.php?id=CVE-2023-0508
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0508.json https://gitlab.com/gitlab-org/gitlab/-/issues/389328 https://hackerone.com/reports/1842314 •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2198
https://notcve.org/view.php?id=CVE-2023-2198
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2198.json https://gitlab.com/gitlab-org/gitlab/-/issues/408273 https://hackerone.com/reports/1947187 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2199
https://notcve.org/view.php?id=CVE-2023-2199
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2199.json https://gitlab.com/gitlab-org/gitlab/-/issues/408272 https://hackerone.com/reports/1943819 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.9EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2485
https://notcve.org/view.php?id=CVE-2023-2485
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2485.json https://gitlab.com/gitlab-org/gitlab/-/issues/407830 https://hackerone.com/reports/1934811 • CWE-269: Improper Privilege Management •