CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-6955 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-6955
An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Existe una vulnerabilidad de control de acceso inadecuado en GitLab Remote Development que afecta a todas las versiones anteriores a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2. Esta condición permite a un atacante crear un workspace en un grupo asociado con un agente de otro grupo. A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. • https://gitlab.com/gitlab-org/gitlab/-/issues/432188 • CWE-284: Improper Access Control CWE-668: Exposure of Resource to Wrong Sphere CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3904 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3904
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido posble hacer un desbordamiento del tiempo dedicado a un issue que alteró los detalles mostrados en los tableros de issues. • https://gitlab.com/gitlab-org/gitlab/-/issues/418226 https://hackerone.com/reports/2053154 • CWE-284: Improper Access Control CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-6051 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-6051
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones desde 15.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2. La integridad del archivo puede verse comprometida cuando el código fuente o los paquetes de instalación se extraen de una etiqueta específica. • https://gitlab.com/gitlab-org/gitlab/-/issues/431345 https://hackerone.com/reports/2237165 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5226 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-5226
An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI. Se ha descubierto un problema en GitLab que afecta a todas las versiones anteriores a 16.4.3, todas las versiones a partir de 16.5 anteriores a 16.5.3, todas las versiones a partir de 16.6 anteriores a 16.6.1. En determinadas circunstancias, un actor malintencionado elude las comprobaciones de sucursales prohibidas utilizando un nombre de sucursal especialmente manipulado para manipular el contenido del repositorio en la interfaz de usuario. • https://gitlab.com/gitlab-org/gitlab/-/issues/426400 https://hackerone.com/reports/2173053 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3246 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-3246
An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. Se ha descubierto un problema en GitLab EE/CE que afecta a todas las versiones anteriores a 16.3.6, todas las versiones desde 16.4 anteriores a 16.4.2, todas las versiones desde 16.5 anteriores a 16.5.1, lo que permite a los atacantes bloquear el procesador de trabajos Sidekiq. • https://gitlab.com/gitlab-org/gitlab/-/issues/415371 https://hackerone.com/reports/2014157 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •