CVSS: 9.6EPSS: 0%CPEs: 6EXPL: 0CVE-2023-2478
https://notcve.org/view.php?id=CVE-2023-2478
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2478.json https://gitlab.com/gitlab-org/gitlab/-/issues/409470 https://hackerone.com/reports/1969599 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-0485
https://notcve.org/view.php?id=CVE-2023-0485
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json https://gitlab.com/gitlab-org/gitlab/-/issues/389191 https://hackerone.com/reports/1837937 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4376
https://notcve.org/view.php?id=CVE-2022-4376
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4376.json https://gitlab.com/gitlab-org/gitlab/-/issues/385246 https://hackerone.com/reports/1794713 •
CVSS: 5.7EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1178
https://notcve.org/view.php?id=CVE-2023-1178
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1178.json https://gitlab.com/gitlab-org/gitlab/-/issues/381815 https://hackerone.com/reports/1778009 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.0EPSS: 1%CPEs: 3EXPL: 0CVE-2023-0756
https://notcve.org/view.php?id=CVE-2023-0756
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0756.json https://gitlab.com/gitlab-org/gitlab/-/issues/390910 https://hackerone.com/reports/1864278 •