CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-2181
https://notcve.org/view.php?id=CVE-2023-2181
An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2181.json https://gitlab.com/gitlab-org/gitlab/-/issues/407859 https://hackerone.com/reports/1938185 •
CVSS: 9.6EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2478
https://notcve.org/view.php?id=CVE-2023-2478
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2478.json https://gitlab.com/gitlab-org/gitlab/-/issues/409470 https://hackerone.com/reports/1969599 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-0485
https://notcve.org/view.php?id=CVE-2023-0485
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json https://gitlab.com/gitlab-org/gitlab/-/issues/389191 https://hackerone.com/reports/1837937 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1265
https://notcve.org/view.php?id=CVE-2023-1265
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1265.json https://gitlab.com/gitlab-org/gitlab/-/issues/394960 https://hackerone.com/reports/1888690 • CWE-384: Session Fixation •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-2069
https://notcve.org/view.php?id=CVE-2023-2069
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2069.json https://gitlab.com/gitlab-org/gitlab/-/issues/407374 https://hackerone.com/reports/1939987 • CWE-668: Exposure of Resource to Wrong Sphere •