CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2761
https://notcve.org/view.php?id=CVE-2022-2761
09 Nov 2022 — An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to. Un problema de divulgación de información en GitLab CE/EE que afecta a todas las versiones desde 14.4 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un atacante utilizar referencias de GitLab... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2761.json •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3483
https://notcve.org/view.php?id=CVE-2022-3483
09 Nov 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 12.1 anteriores a 15.3.5, todas las versiones... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3483.json •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3486
https://notcve.org/view.php?id=CVE-2022-3486
09 Nov 2022 — An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. Una vulnerabilidad de redireccionamiento abierto en GitLab EE/CE que afecta a todas las versiones desde la 9.3 anterior a la 15.3.5, la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2, permite a un atacante redirigir a los usuarios a una ubicación arbitraria si confían en l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3706
https://notcve.org/view.php?id=CVE-2022-3706
09 Nov 2022 — Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project. La autorización inadecuada en GitLab CE/EE que afecta a todas las versiones desde 7.14 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un usuario reintentar un trabajo en una c... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3706.json •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3726
https://notcve.org/view.php?id=CVE-2022-3726
09 Nov 2022 — Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account. La falta de espacio aislado de los documentos OpenAPI en GitLab CE/EE que afecta a todas las versiones desde 12.6 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un atacante engañar a un usuario pa... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3726.json •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3793
https://notcve.org/view.php?id=CVE-2022-3793
09 Nov 2022 — An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to. Un problema de autorización inadecuada en GitLab CE/EE que afecta a todas las versiones desde 14.4 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un atacante leer variables configuradas directamente en un archivo de configu... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3793.json •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3818
https://notcve.org/view.php?id=CVE-2022-3818
09 Nov 2022 — An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance. Un problema de consumo de recursos no controlado al analizar URL en GitLab CE/EE que afecta a todas las versiones anteriores a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite que un atacante cause problemas de rendimiento y p... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3818.json • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3819
https://notcve.org/view.php?id=CVE-2022-3819
09 Nov 2022 — An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to. Un problema de autorización inadecuada en GitLab CE/EE que afecta a todas las versiones desde 15.0 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a usuarios malintencionados configurar emojis en notas internas a las que no tienen acceso. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3819.json • CWE-863: Incorrect Authorization •