CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-4365
https://notcve.org/view.php?id=CVE-2022-4365
12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 11.8 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4365.json •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3514
https://notcve.org/view.php?id=CVE-2022-3514
12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 6.6 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las versiones desde 15.7 anteri... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3514.json • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3870
https://notcve.org/view.php?id=CVE-2022-3870
12 Jan 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 10.0 anteriores a 15.5.7, todas las versiones desde 15.6 anteriores a 15.6.4, todas las... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3870.json •
CVSS: 7.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3265
https://notcve.org/view.php?id=CVE-2022-3265
09 Nov 2022 — A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Se descubrió un problema de Cross-Site Scripting (XSS) en GitLab CE/EE que afecta a todas las versiones anteriores a 15.3.5, 15.4 anteriores a 15.4.4 y 15.5 ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3265.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3280
https://notcve.org/view.php?id=CVE-2022-3280
09 Nov 2022 — An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content. Una redirección abierta en GitLab CE/EE que afecta a todas las versiones desde 10.1 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un atacante engañar a los usuarios para que visiten una URL confiable y sean redirigidos a contenido arbitrario. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3280.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3285
https://notcve.org/view.php?id=CVE-2022-3285
09 Nov 2022 — Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab Omitir la lista de permitidos del endpoint de Healthcheck que afecta a todas las versiones desde 12.0 anterior a 15.2.5, 15.3 anterior a 15.3.4 y 15.4 anterior a 15.4.1 permite a un atacante no autorizado impedir el acceso a GitLab • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3285.json •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3483
https://notcve.org/view.php?id=CVE-2022-3483
09 Nov 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 12.1 anteriores a 15.3.5, todas las versiones... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3483.json •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3486
https://notcve.org/view.php?id=CVE-2022-3486
09 Nov 2022 — An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. Una vulnerabilidad de redireccionamiento abierto en GitLab EE/CE que afecta a todas las versiones desde la 9.3 anterior a la 15.3.5, la 15.4 anterior a la 15.4.4 y la 15.5 anterior a la 15.5.2, permite a un atacante redirigir a los usuarios a una ubicación arbitraria si confían en l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3413
https://notcve.org/view.php?id=CVE-2022-3413
09 Nov 2022 — Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above. La autorización incorrecta durante la visualización de eventos de auditoría en GitLab EE que afecta a todas las versiones desde 14.5 anterior a 1... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3706
https://notcve.org/view.php?id=CVE-2022-3706
09 Nov 2022 — Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project. La autorización inadecuada en GitLab CE/EE que afecta a todas las versiones desde 7.14 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2 permite a un usuario reintentar un trabajo en una c... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3706.json •