CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3509 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3509
An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group. Se descubrió un problema en GitLab que afecta a todas las versiones anteriores a 16.7.6, todas las versiones desde 16.8 anteriores a 16.8.3, todas las versiones desde 16.9 anteriores a 16.9.1. Los miembros del grupo con función de submantenedor podían cambiar el título de las claves de implementación de acceso privado asociadas con los proyectos del grupo. • https://gitlab.com/gitlab-org/gitlab/-/issues/416945 https://hackerone.com/reports/2037814 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5612 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5612
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled. Se descubrió un problema en GitLab que afecta a todas las versiones anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. Era posible leer la dirección de correo electrónico del usuario a través del feed de etiquetas, aunque la visibilidad en el perfil del usuario se ha desactivado. An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released https://gitlab.com/gitlab-org/gitlab/-/issues/428441 https://hackerone.com/reports/2208790 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-6955 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-6955
An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Existe una vulnerabilidad de control de acceso inadecuado en GitLab Remote Development que afecta a todas las versiones anteriores a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2. Esta condición permite a un atacante crear un workspace en un grupo asociado con un agente de otro grupo. A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. • https://gitlab.com/gitlab-org/gitlab/-/issues/432188 • CWE-284: Improper Access Control CWE-668: Exposure of Resource to Wrong Sphere CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3904 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3904
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido posble hacer un desbordamiento del tiempo dedicado a un issue que alteró los detalles mostrados en los tableros de issues. • https://gitlab.com/gitlab-org/gitlab/-/issues/418226 https://hackerone.com/reports/2053154 • CWE-284: Improper Access Control CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-6051 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-6051
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones desde 15.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2. La integridad del archivo puede verse comprometida cuando el código fuente o los paquetes de instalación se extraen de una etiqueta específica. • https://gitlab.com/gitlab-org/gitlab/-/issues/431345 https://hackerone.com/reports/2237165 • CWE-94: Improper Control of Generation of Code ('Code Injection') •