CVSS: 6.4EPSS: 18%CPEs: 6EXPL: 0CVE-2023-0523
https://notcve.org/view.php?id=CVE-2023-0523
05 Apr 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0523.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0838
https://notcve.org/view.php?id=CVE-2023-0838
05 Apr 2023 — An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.json • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3381
https://notcve.org/view.php?id=CVE-2022-3381
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3381.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-4462
https://notcve.org/view.php?id=CVE-2022-4462
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4462.json •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0483
https://notcve.org/view.php?id=CVE-2023-0483
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0483.json •
CVSS: 3.3EPSS: 1%CPEs: 6EXPL: 0CVE-2023-1084
https://notcve.org/view.php?id=CVE-2023-1084
09 Mar 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1084.json •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4331
https://notcve.org/view.php?id=CVE-2022-4331
09 Mar 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4331.json • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0CVE-2023-0223
https://notcve.org/view.php?id=CVE-2023-0223
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0223.json •
CVSS: 8.7EPSS: 78%CPEs: 6EXPL: 0CVE-2023-0050
https://notcve.org/view.php?id=CVE-2023-0050
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0050.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3758
https://notcve.org/view.php?id=CVE-2022-3758
09 Mar 2023 — An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3758.json • CWE-276: Incorrect Default Permissions •