CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0390
https://notcve.org/view.php?id=CVE-2022-0390
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard. Un control de acceso inapropiado en Gitlab CE/EE versiones 12.7 a 14.5.4, 14.6 a 14.6.4 y 14.7 a 14.7.1, permitía a personas que no eran miembros del proyecto recuperar los detalles de las incidencias cuando estaban vinculadas a un elemento del panel de control de vulnerabilidades • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0390.json https://gitlab.com/gitlab-org/gitlab/-/issues/330030 https://hackerone.com/reports/1179733 • CWE-862: Missing Authorization •
CVSS: 5.7EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0489
https://notcve.org/view.php?id=CVE-2022-0489
An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments. Se ha detectado un problema en GitLab CE/EE afectando a todas las versiones a partir de la 8.15 . Era posible desencadenar un DOS usando la función de matemáticas con una fórmula específica en los comentarios de la edición • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0489.json https://gitlab.com/gitlab-org/gitlab/-/issues/341832 https://hackerone.com/reports/1350793 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 76%CPEs: 6EXPL: 1CVE-2021-4191 – GitLab GraphQL API User Enumeration
https://notcve.org/view.php?id=CVE-2021-4191
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API. Se ha detectado un problema en GitLab CE/EE afectando las versiones 13.0 a 14.6.5, 14.7 a 14.7.4 y 14.8 a 14.8.2. Las instancias privadas de GitLab con registros restringidos pueden ser vulnerables a una enumeración de usuarios a usuarios no autenticados mediante la API GraphQL • https://github.com/K3ysTr0K3R/CVE-2021-4191-EXPLOIT https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4191.json https://gitlab.com/gitlab-org/gitlab/-/issues/343898 https://hackerone.com/reports/1089609 •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-0136
https://notcve.org/view.php?id=CVE-2022-0136
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature. Se ha detectado una vulnerabilidad en GitLab versiones 10.5 a 14.5.4, 14.6 a 14.6.4 y 14.7 a 14.7.1. GitLab era vulnerable a un ataque de tipo SSRF ciego mediante la funcionalidad Project Import • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.json https://gitlab.com/gitlab-org/gitlab/-/issues/28561 https://hackerone.com/reports/560658 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2021-39876
https://notcve.org/view.php?id=CVE-2021-39876
In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. En todas las versiones de GitLab CE/EE desde versión 11.3, el endpoint para autocompletar la asignación divulga los miembros de los grupos privados • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39876.json https://gitlab.com/gitlab-org/gitlab/-/issues/29683 https://hackerone.com/reports/627507 • CWE-863: Incorrect Authorization •