CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0483
https://notcve.org/view.php?id=CVE-2023-0483
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0483.json https://gitlab.com/gitlab-org/gitlab/-/issues/389188 https://hackerone.com/reports/1836466 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0223
https://notcve.org/view.php?id=CVE-2023-0223
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0223.json https://gitlab.com/gitlab-org/gitlab/-/issues/387870 https://hackerone.com/reports/1824226 •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-4289
https://notcve.org/view.php?id=CVE-2022-4289
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4289.json https://gitlab.com/gitlab-org/gitlab/-/issues/384580 https://hackerone.com/reports/1780770 https://security.netapp.com/advisory/ntap-20240415-0004 •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3758
https://notcve.org/view.php?id=CVE-2022-3758
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3758.json https://gitlab.com/gitlab-org/gitlab/-/issues/379598 https://hackerone.com/reports/1751258 • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-4007
https://notcve.org/view.php?id=CVE-2022-4007
A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4007.json https://gitlab.com/gitlab-org/gitlab/-/issues/382789 https://hackerone.com/reports/1767745 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •