CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 1CVE-2022-3572
https://notcve.org/view.php?id=CVE-2022-3572
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims. Se descubrió un problema de cross site scripting en GitLab CE/EE que afecta a todas las versiones desde 13.5 anterior a 15.3.5, 15.4 anterior a 15.4.4 y 15.5 anterior a 15.5.2. Fue posible explotar una vulnerabilidad al configurar la integración de Jira Connect, lo que podría conducir a un XSS reflejado que permitiera a los atacantes realizar acciones arbitrarias en nombre de las víctimas. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3572.json https://gitlab.com/gitlab-org/gitlab/-/issues/378214 https://hackerone.com/reports/1727985 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2022-3482
https://notcve.org/view.php?id=CVE-2022-3482
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3482.json https://gitlab.com/gitlab-org/gitlab/-/issues/377802 https://hackerone.com/reports/1725841 • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1CVE-2022-3902
https://notcve.org/view.php?id=CVE-2022-3902
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 9.3 anteriores a 15.4.6, todas las versiones desde 15.5 anteriores a 15.5.5, todas las versiones desde 15.6 anteriores a 15.6.1. Un responsable del proyecto pudo desenmascarar los tokens secretos de los webhooks revisando los registros después de probar los webhooks. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json https://gitlab.com/gitlab-org/gitlab/-/issues/381895 https://hackerone.com/reports/1757999 •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-4092
https://notcve.org/view.php?id=CVE-2022-4092
An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4092.json https://gitlab.com/gitlab-org/gitlab/-/issues/383208 https://hackerone.com/reports/1777934 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3740
https://notcve.org/view.php?id=CVE-2022-3740
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys . • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3740.json https://gitlab.com/gitlab-org/gitlab/-/issues/368416 https://hackerone.com/reports/1602904 •