CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0125
https://notcve.org/view.php?id=CVE-2022-0125
18 Jan 2022 — An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de la 12.0 anteriores a 14.4.5, todas las versiones a partir de la 14.5.0 anteriores a 14.5.3, todas las versiones a par... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0125.json • CWE-862: Missing Authorization •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0154
https://notcve.org/view.php?id=CVE-2022-0154
18 Jan 2022 — An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de la 7.7 anteriores a 14.4.5, a todas las versiones a partir de la 14.5.0 ante... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0124
https://notcve.org/view.php?id=CVE-2022-0124
18 Jan 2022 — An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack. Se ha detectado un problema que afecta a las versiones de GitLab anteriores a 14.4.5, entre 14.5.0 y 14.5.3, y entre 14.6.0 y 14.6.1. La integración de Gitlab con Slack comprueba incorrectamente las entradas de los usuarios y permite que se diseñen URLs malic... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.json • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0151
https://notcve.org/view.php?id=CVE-2022-0151
18 Jan 2022 — An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions. Se ha detectado un problema en GitLab que afecta a todas las versiones a partir de la 12.10 anteriores a 14.4.5, todas las versiones a partir de la 14.5.0 anteriores a 14.5.3, t... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0151.json •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39927
https://notcve.org/view.php?id=CVE-2021-39927
18 Jan 2022 — Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443 Las protecciones contra la falsificación de solicitudes del lado del servidor en las versiones de GitLab CE/EE entre 8.4 y 14.4.4, entre 14.5.0 y 14.5.2, y entre 14.6.0 y 14.6.1 fallaban en la protección contra los at... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39927.json • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0172
https://notcve.org/view.php?id=CVE-2022-0172
18 Jan 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones. Se ha detectado un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 12.3. Bajo determinadas condiciones era posible omitir la restricción de IP para proyectos públicos mediante GraphQL permitiendo a usuarios n... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0172.json •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39930
https://notcve.org/view.php?id=CVE-2021-39930
13 Dec 2021 — Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates Una falta de autorización en GitLab EE versiones entre la 12.4 y la 14.3.6, entre la 14.4.0 y la 14.4.4, y entre la 14.5.0 y la 14.5.2, permitía a un atacante acceder a las plantillas personalizadas de proyectos y grupos de un usuario • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39930.json • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39941
https://notcve.org/view.php?id=CVE-2021-39941
13 Dec 2021 — An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members Una vulnerabilidad de divulgación de información en GitLab CE/EE versiones 12.0 a 14.3.6, 14.4 a 14.4.4 y 14.5 a 14.5.2, permitía a los no miembros del proyecto visualizar el nombre de la rama por defecto de los proyectos que restringen el acceso al repositorio a lo... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39941.json • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39935
https://notcve.org/view.php?id=CVE-2021-39935
13 Dec 2021 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 10.5 anteriores a 14.3.6, todas las versiones a partir de 14.4 anteriores a 14.4.4, todas las versiones a partir de 14.5 anteriores a 14.5.2. Los... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39932
https://notcve.org/view.php?id=CVE-2021-39932
13 Dec 2021 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 11.0 anteriores a 14.3.6, todas las versiones a partir de 14.4 anteriores a 14.4.4, todas las versiones a partir de... • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39932.json • CWE-20: Improper Input Validation •