CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3413
https://notcve.org/view.php?id=CVE-2022-3413
09 Nov 2022 — Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above. La autorización incorrecta durante la visualización de eventos de auditoría en GitLab EE que afecta a todas las versiones desde 14.5 anterior a 1... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3726
https://notcve.org/view.php?id=CVE-2022-3726
09 Nov 2022 — Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account. La falta de espacio aislado de los documentos OpenAPI en GitLab CE/EE que afecta a todas las versiones desde 12.6 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un atacante engañar a un usuario pa... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3726.json •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3486
https://notcve.org/view.php?id=CVE-2022-3486
09 Nov 2022 — An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. Una vulnerabilidad de redireccionamiento abierto en GitLab EE/CE que afecta a todas las versiones desde la 9.3 anterior a la 15.3.5, la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2, permite a un atacante redirigir a los usuarios a una ubicación arbitraria si confían en l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3483
https://notcve.org/view.php?id=CVE-2022-3483
09 Nov 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 12.1 anteriores a 15.3.5, todas las versiones... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3483.json •