Page 39 of 514 results (0.004 seconds)

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0

An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0838.json https://gitlab.com/gitlab-org/gitlab/-/issues/391685 https://hackerone.com/reports/1871136 •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1071.json https://gitlab.com/gitlab-org/gitlab/-/issues/385434 • CWE-863: Incorrect Authorization •

CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0

An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1098.json https://gitlab.com/gitlab-org/gitlab/-/issues/383745 https://hackerone.com/reports/1784294 •

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1167.json https://gitlab.com/gitlab-org/gitlab/-/issues/392715 • CWE-862: Missing Authorization •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1417.json https://gitlab.com/gitlab-org/gitlab/-/issues/396720 https://hackerone.com/reports/1892200 • CWE-863: Incorrect Authorization •