CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3293
https://notcve.org/view.php?id=CVE-2022-3293
17 Oct 2022 — Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 Fueron filtrados direcciones de correo electrónico en los registros de WebHook en GitLab EE afectando a todas las versiones desde la 9.3 anteriores a 15.2.5, la 15.3 anteriores a 15.3.4 y la 15.4 anteriores a 15.4.1 • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3293.json • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3325
https://notcve.org/view.php?id=CVE-2022-3325
17 Oct 2022 — Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user. Control de acceso inapropiado en la API de GitLab CE/EE afectando a todas las versiones a partir de 12.8 anteriores a 15.2.5, a todas las versiones a partir de 15.3 anteriores a 15.3.4, a todas las versiones a partir de 15.4 anteriores a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3330
https://notcve.org/view.php?id=CVE-2022-3330
17 Oct 2022 — It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1. Era posible que un usuario invitado leyera una tarea dirigida a una nota inaccesible en Gitlab CE/EE, lo que afectaba a todas las versiones desde la 15.0 hasta la 15.2.5, la 15.3 hasta la 15.3.4 y la 15.4 hasta la 15.4.1 • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3330.json •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2022-3331
https://notcve.org/view.php?id=CVE-2022-3331
17 Oct 2022 — An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues. Se ha detectado un problema en GitLab EE afectando a todas las versiones a partir de 14.5 anteriores a 15.1.6, todas las versiones a partir de 15.2 anteriores a 15.2.4, ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3331.json • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2527
https://notcve.org/view.php?id=CVE-2022-2527
17 Oct 2022 — An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests. Se ha detectado un problema en las líneas de tiempo de incidentes en GitLab CE/EE afectando a todas las versiones a partir de 14.9 anteriores a 15.1.6, a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2527.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-2630
https://notcve.org/view.php?id=CVE-2022-2630
17 Oct 2022 — An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events. Se ha detectado que EOS versión v2.1.0, contenía un desbordamiento del búfer de la pila por medio de la función txn_test_gen_plugin • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2630.json •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2095
https://notcve.org/view.php?id=CVE-2022-2095
05 Aug 2022 — An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key. Una comprobación de control de acceso inapropiada en GitLab CE/EE afectando a todas las versiones a partir de 1... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2095.json • CWE-863: Incorrect Authorization •
CVSS: 3.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2459
https://notcve.org/view.php?id=CVE-2022-2459
05 Aug 2022 — An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled. Se ha detectado un problema en GitLab EE afectando a todas las versiones anteriores a la 15.0.5, a todas las ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2459.json • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2500
https://notcve.org/view.php?id=CVE-2022-2500
05 Aug 2022 — A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side. Se ha detectado un problema de tipo cross-site scripting en GitLab CE/EE afectando a todas las versiones anteriores a 15.0.5, a 15.1 anterior a 15.1.4 y 15.2 anteriores a 15.2.1. Un fallo de tipo XSS almacenado en los mensajes de error de... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2500.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2501
https://notcve.org/view.php?id=CVE-2022-2501
05 Aug 2022 — An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required. Un problema de control de acceso inapropiado en GitLab EE afectando a todas las versiones desde la 12.0 anteriores a 15.0.5, la 15.1 anteriores a 15.1.4 y la 15.2 anteriores a 15.2.1 permite a un atacante omitir la l... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2501.json • CWE-863: Incorrect Authorization •