Page 7 of 567 results (0.012 seconds)

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3979 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-3979

29 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 10.6 anteriores a 16.2.8, todas las versiones desde 16.3 anteriores a 16.3.5, todas las versiones desde ... • https://gitlab.com/gitlab-org/gitlab/-/issues/419972 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •

CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-4630 – Missing Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-4630

11 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 10.6 anteriores a 16.1.5, todas las versiones desde 16.2 anteriores a 16.2.5, todas las versiones desde 16.3 anteriores a 16.3.1 en el que cualquier usuario puede leer ... • https://about.gitlab.com/releases/2023/08/31/security-release-gitlab-16-3-1-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •

CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-4378 – Insertion of Sensitive Information Into Sent Data in GitLab

https://notcve.org/view.php?id=CVE-2023-4378

01 Sep 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365. • https://gitlab.com/gitlab-org/gitlab/-/issues/422134 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-201: Insertion of Sensitive Information Into Sent Data •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-0120 – Incorrect Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-0120

01 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de la 10.0 antes de la 16.1.5, todas las versiones a partir de la 16.2 antes de la 16.2.5 y todas las versiones a partir de la 16.3 an... • https://gitlab.com/gitlab-org/gitlab/-/issues/387531 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-1279 – URL Redirection to Untrusted Site in GitLab

https://notcve.org/view.php?id=CVE-2023-1279

01 Sep 2023 — An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project. Se ha descubierto un problema en GitLab que afecta a todas las versiones a partir de 4.1 y antes de 16.1.5, todas las versiones a partir de 16.2 y antes de 16.2.5, todas las versiones a partir de 16.3 y antes de 16.3.1, donde es posible crear... • https://gitlab.com/gitlab-org/gitlab/-/issues/395437 • CWE-138: Improper Neutralization of Special Elements CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2

CVE-2023-4522 – Improper Validation of Specified Type of Input in GitLab

https://notcve.org/view.php?id=CVE-2023-4522

30 Aug 2023 — An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit. • https://gitlab.com/gitlab-org/gitlab/-/issues/406817 • CWE-138: Improper Neutralization of Special Elements CWE-1287: Improper Validation of Specified Type of Input •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-2022 – Missing Authorization in GitLab

https://notcve.org/view.php?id=CVE-2023-2022

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge • https://gitlab.com/gitlab-org/gitlab/-/issues/407166 • CWE-262: Not Using Password Aging CWE-284: Improper Access Control •

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2023-3401 – Improper Control of Generation of Code ('Code Injection') in GitLab

https://notcve.org/view.php?id=CVE-2023-3401

02 Aug 2023 — An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code. • https://gitlab.com/gitlab-org/gitlab/-/issues/416252 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3500 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

https://notcve.org/view.php?id=CVE-2023-3500

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 10.0 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de l... • https://gitlab.com/gitlab-org/gitlab/-/issues/416902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1

CVE-2023-3994 – Inefficient Regular Expression Complexity in GitLab

https://notcve.org/view.php?id=CVE-2023-3994

02 Aug 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 9.3 antes de la 16.0.8, todas las versiones a partir de la 16.1 antes de la... • https://gitlab.com/gitlab-org/gitlab/-/issues/416225 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •