Page 29 of 295 results (0.022 seconds)

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-4007

https://notcve.org/view.php?id=CVE-2022-4007

08 Mar 2023 — A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4007.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-3759

https://notcve.org/view.php?id=CVE-2022-3759

13 Feb 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3759.json •

CVSS: 9.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-4138

https://notcve.org/view.php?id=CVE-2022-4138

13 Feb 2023 — A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4138.json • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-0518

https://notcve.org/view.php?id=CVE-2023-0518

13 Feb 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0518.json •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-3411

https://notcve.org/view.php?id=CVE-2022-3411

13 Feb 2023 — A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3411.json • CWE-1284: Improper Validation of Specified Quantity in Input •

CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-3514

https://notcve.org/view.php?id=CVE-2022-3514

12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 6.6 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.7 anteri... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3514.json • CWE-1333: Inefficient Regular Expression Complexity •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2022-4167

https://notcve.org/view.php?id=CVE-2022-4167

12 Jan 2023 — Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them. La verificación de autorización incorrecta que afecta a todas las versiones de GitLab EE desde la 13.11 anterior a la 15.5.7, la 15.6 anterior a la 15.6.4 y la 15.7 anterior a la 15.7.2 permite que los tokens de acceso al grupo sigan funcionando incluso después d... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4167.json • CWE-863: Incorrect Authorization •

CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2022-3573

https://notcve.org/view.php?id=CVE-2022-3573

12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-4365

https://notcve.org/view.php?id=CVE-2022-4365

12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 11.8 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4365.json •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2022-3613

https://notcve.org/view.php?id=CVE-2022-3613

12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.7 anteriores a 15.7.2. Una consulta del servidor Prome... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3613.json •