CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4011 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-4011
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS. • https://gitlab.com/gitlab-org/gitlab/-/issues/409367 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3500 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
https://notcve.org/view.php?id=CVE-2023-3500
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 10.0 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Un XSS reflejado era posible al crear diagramas PlantUML específicos que permitían al atacante realizar acciones arbitrarias en nombre de las víctimas. • https://gitlab.com/gitlab-org/gitlab/-/issues/416902 https://hackerone.com/reports/2010926 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2023-3900 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3900
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de 16.1 antes de 16.1.3, todas las versiones a partir de 16.2 antes de 16.2.2. Un valor no válido de 'start_sha' en la página de solicitudes de fusión puede provocar una denegación de servicio, ya que la pestaña Cambios no se carga. • https://gitlab.com/gitlab-org/gitlab/-/issues/418770 https://hackerone.com/reports/2058514 • CWE-20: Improper Input Validation CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-3993 – Insertion of Sensitive Information into Log File in GitLab
https://notcve.org/view.php?id=CVE-2023-3993
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones a partir de la 14.3 antes de la 16.0.8, a todas las versiones a partir de la 16.1 antes de la 16.1.3, a todas las versiones a partir de la 16.2 antes de la 16.2.2. Es posible que se hayan registrado tokens de acceso al realizar una consulta a un endpoint específico. • https://gitlab.com/gitlab-org/gitlab/-/issues/409570 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3994 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3994
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la 16.1.3, todas las versiones a partir de la 16.2 antes de la 16.2.2. Una Denegación de Servicio de Expresión Regular era posible a través del envío de payloads elaborados que utilizan ProjectReferenceFilter al endpoint preview_markdown. • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 https://hackerone.com/reports/1963255 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •