CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2023-2198
https://notcve.org/view.php?id=CVE-2023-2198
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2198.json • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2023-2199
https://notcve.org/view.php?id=CVE-2023-2199
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2199.json • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1825 – Insertion of Sensitive Information Into Sent Data in GitLab
https://notcve.org/view.php?id=CVE-2023-1825
07 Jun 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1825.json • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2013
https://notcve.org/view.php?id=CVE-2023-2013
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2013.json • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2589
https://notcve.org/view.php?id=CVE-2023-2589
07 Jun 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2589.json • CWE-346: Origin Validation Error •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2001
https://notcve.org/view.php?id=CVE-2023-2001
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json • CWE-290: Authentication Bypass by Spoofing •
CVSS: 6.4EPSS: 4%CPEs: 6EXPL: 0CVE-2023-2015
https://notcve.org/view.php?id=CVE-2023-2015
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2015.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2485 – Incorrect Privilege Assignment in GitLab
https://notcve.org/view.php?id=CVE-2023-2485
07 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2485.json • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1621
https://notcve.org/view.php?id=CVE-2023-1621
06 Jun 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1621.json •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2023-2132
https://notcve.org/view.php?id=CVE-2023-2132
06 Jun 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2132.json • CWE-1333: Inefficient Regular Expression Complexity •