CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5933 – Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
https://notcve.org/view.php?id=CVE-2023-5933
26 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones posteriores a 13.7 anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. La sanitización inadecuada de la entrada del nombre de usuario permite solicitudes PUT de API arbitrarias. • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-0456 – Direct Request ('Forced Browsing') in GitLab
https://notcve.org/view.php?id=CVE-2024-0456
26 Jan 2024 — An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project Existe una vulnerabilidad de autorización en las versiones de GitLab 14.0 anteriores a 16.6.6, 16.7 anteriores a 16.7.4 y 16.8 anteriores a 16.8.1. Un atacante no autorizado puede asignar usuarios arbitrarios a los MR que crearon dentro del proyecto. • https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released • CWE-285: Improper Authorization CWE-425: Direct Request ('Forced Browsing') •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 1CVE-2023-2030 – Improper Verification of Cryptographic Signature in GitLab
https://notcve.org/view.php?id=CVE-2023-2030
12 Jan 2024 — An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde 12.2 anterior a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2 en el que un atacante podría modificar los metadatos de las confirmaciones firmadas. • https://gitlab.com/gitlab-org/gitlab/-/issues/407252 • CWE-345: Insufficient Verification of Data Authenticity CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 1CVE-2023-5356 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5356
12 Jan 2024 — Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user. Verificaciones de autorización incorrectas en GitLab CE/EE desde todas las versiones desde 8.13 anteriores a 16.5.6, todas las versiones desde 16.6 anteriores a 16.6.4, todas las versiones desde 16.7 anteriores a 16.7.2, pe... • https://gitlab.com/gitlab-org/gitlab/-/issues/427154 • CWE-863: Incorrect Authorization •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-6955 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-6955
12 Jan 2024 — An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Existe una vulnerabilidad de control de acceso inadecuado en GitLab Remote Development que afecta a todas las versiones anteriores a 16.5.6, 16.6 anterior a 16.6.4 y 16.7 anterior a 16.7.2. Esta condición permite a un atacante... • https://gitlab.com/gitlab-org/gitlab/-/issues/432188 • CWE-284: Improper Access Control CWE-668: Exposure of Resource to Wrong Sphere CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3904 – Improper Validation of Specified Type of Input in GitLab
https://notcve.org/view.php?id=CVE-2023-3904
15 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards. Se ha descubierto un problema en GitLab EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones anteriores a 16.5 anteriores a 16.5.4, todas las versiones anteriores a 16.6 anteriores a 16.6.2. Ha sido... • https://gitlab.com/gitlab-org/gitlab/-/issues/418226 • CWE-284: Improper Access Control CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5061 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5061
15 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 9.3 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.... • https://gitlab.com/gitlab-org/gitlab/-/issues/425521 • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-6051 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-6051
15 Dec 2023 — An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag. Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.4.4, todas las versiones desde 15.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2. La integridad del archivo pu... • https://gitlab.com/gitlab-org/gitlab/-/issues/431345 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-6680 – Improper Certificate Validation in GitLab
https://notcve.org/view.php?id=CVE-2023-6680
15 Dec 2023 — An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator. Un problema de validación de certificado incorrecto en la autenticación de tarjeta inteligente en GitLab EE que afect... • https://gitlab.com/gitlab-org/gitlab/-/issues/421607 • CWE-295: Improper Certificate Validation •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3511 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3511
15 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 8.17 anteriores a 16.4.4, todas las versiones desde 16.5 anteriores a 16.5.4, todas las versiones desde 16.6 anteriores a 16.6.2.... • https://gitlab.com/gitlab-org/gitlab/-/issues/416961 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •