Page 31 of 1059 results (0.017 seconds)

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-0155

https://notcve.org/view.php?id=CVE-2023-0155

03 May 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0155.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 6.8EPSS: 2%CPEs: 6EXPL: 0

CVE-2023-1178

https://notcve.org/view.php?id=CVE-2023-1178

03 May 2023 — An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-0485

https://notcve.org/view.php?id=CVE-2023-0485

03 May 2023 — An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json • CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-1204

https://notcve.org/view.php?id=CVE-2023-1204

03 May 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1204.json • CWE-347: Improper Verification of Cryptographic Signature •

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1

CVE-2023-2182

https://notcve.org/view.php?id=CVE-2023-2182

03 May 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2182.json •

CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-0805

https://notcve.org/view.php?id=CVE-2023-0805

03 May 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0805.json • CWE-862: Missing Authorization •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-1265

https://notcve.org/view.php?id=CVE-2023-1265

03 May 2023 — An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json • CWE-384: Session Fixation •

CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2019-14942

https://notcve.org/view.php?id=CVE-2019-14942

15 Apr 2023 — An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP. • https://about.gitlab.com/blog/categories/releases • CWE-319: Cleartext Transmission of Sensitive Information •

CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1

CVE-2019-14944

https://notcve.org/view.php?id=CVE-2019-14944

15 Apr 2023 — An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution. • https://about.gitlab.com/blog/categories/releases • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0

CVE-2023-1710

https://notcve.org/view.php?id=CVE-2023-1710

05 Apr 2023 — A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1710.json • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •