CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2498
https://notcve.org/view.php?id=CVE-2022-2498
05 Aug 2022 — An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author. Un problema en las suscripciones a pipelines en GitLab EE afectando a todas las versiones desde la 12.8 anteriores a 15.0.5, la 15.1 anteriores a 15.1.4 y la 15.2 anteriores a 15.2.1, desencadena nuevos pipelines con la persona que creó la etiqu... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2498.json • CWE-269: Improper Privilege Management •
CVSS: 4.9EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2456
https://notcve.org/view.php?id=CVE-2022-2456
05 Aug 2022 — An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones anteriores a la 15.0.5, a todas las versiones a partir de 15.1 anteriores a 15.1.4 y a todas las vers... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2456.json •
CVSS: 6.2EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2417
https://notcve.org/view.php?id=CVE-2022-2417
05 Aug 2022 — Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project. Una comprobación insuficiente en GitLab CE/EE afectando a todas las versiones a partir de 12.10 anteriores a 15.0.5, la 15.1 anteriores a... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2417.json • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2539
https://notcve.org/view.php?id=CVE-2022-2539
05 Aug 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 14.6 anterior a la 15.0.5, la 15.1 anterior a la 15.1.4 y la 15.2 anterior a la 15.2.1, que permitía a un miembro del proyecto filtrar las incidencias por contacto y organización • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2539.json •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2512
https://notcve.org/view.php?id=CVE-2022-2512
05 Aug 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de 15.0 anteriores a 15.0.5, todas las versiones a partir de 15.1 anteriores a 15.1.4, todas las vers... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2512.json •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2499
https://notcve.org/view.php?id=CVE-2022-2499
05 Aug 2022 — An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues. Se ha detectado un problema en GitLab EE afectando a todas las versiones a partir de 13.10 anteriores a 15.0.5, a todas las versiones a partir de 15.1 anteriores a 15.1.4, a todas ... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2499.json • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-2497
https://notcve.org/view.php?id=CVE-2022-2497
05 Aug 2022 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 12.6 antes de la 15.0.5, todas las versiones... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2497.json •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2531
https://notcve.org/view.php?id=CVE-2022-2531
05 Aug 2022 — An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability. Se ha detectado un problema en GitLab EE afectando a todas las versiones a partir de 12.5 anteriores a 15.0.5, todas las versiones a partir... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2531.json • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2022-1948
https://notcve.org/view.php?id=CVE-2022-1948
28 Jul 2022 — An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details. Se ha detectado un problema en GitLab afectando a todas las versiones desde 15.0 hasta 15.0.1. Una falta de comprobación de la entrada usada en las acciones rápidas permitía a un atacante explotar una vulnerabilidad de tipo XSS al inyectar HTML en los datos de contacto • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0167
https://notcve.org/view.php?id=CVE-2022-0167
01 Jul 2022 — An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions. Se ha detectado un problema en GitLab afectando a todas las versiones a partir de la 14.0 anteriores a 14.4.5, todas las versiones a partir de la 14.5.0 anteriore... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0167.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •