CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0838
https://notcve.org/view.php?id=CVE-2023-0838
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.json https://gitlab.com/gitlab-org/gitlab/-/issues/391685 https://hackerone.com/reports/1871136 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1167
https://notcve.org/view.php?id=CVE-2023-1167
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json https://gitlab.com/gitlab-org/gitlab/-/issues/392715 • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1708
https://notcve.org/view.php?id=CVE-2023-1708
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1708.json https://gitlab.com/gitlab-org/gitlab/-/issues/387185 https://hackerone.com/reports/1805604 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0523
https://notcve.org/view.php?id=CVE-2023-0523
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0523.json https://gitlab.com/gitlab-org/gitlab/-/issues/389487 https://hackerone.com/reports/1842867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1098
https://notcve.org/view.php?id=CVE-2023-1098
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.json https://gitlab.com/gitlab-org/gitlab/-/issues/383745 https://hackerone.com/reports/1784294 •