CVSS: 4.6EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0450
https://notcve.org/view.php?id=CVE-2023-0450
An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0450.json https://gitlab.com/gitlab-org/gitlab/-/issues/388962 https://hackerone.com/reports/1831547 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0838
https://notcve.org/view.php?id=CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.json https://gitlab.com/gitlab-org/gitlab/-/issues/391685 https://hackerone.com/reports/1871136 •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1098
https://notcve.org/view.php?id=CVE-2023-1098
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.json https://gitlab.com/gitlab-org/gitlab/-/issues/383745 https://hackerone.com/reports/1784294 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1167
https://notcve.org/view.php?id=CVE-2023-1167
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json https://gitlab.com/gitlab-org/gitlab/-/issues/392715 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1710
https://notcve.org/view.php?id=CVE-2023-1710
A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1710.json https://gitlab.com/gitlab-org/gitlab/-/issues/388242 https://hackerone.com/reports/1829768 •