CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3964 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-3964
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 13.2 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 16.6 ... • https://gitlab.com/gitlab-org/gitlab/-/issues/419857 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3949 – Insertion of Sensitive Information Into Sent Data in GitLab
https://notcve.org/view.php?id=CVE-2023-3949
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 11.3 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores ... • https://gitlab.com/gitlab-org/gitlab/-/issues/419664 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-4317 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-4317
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch. Se ha descubierto un problema en GitLab que afecta a todas las versiones desde 9.2 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 16.6 anter... • https://gitlab.com/gitlab-org/gitlab/-/issues/421846 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4658 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-4658
01 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 8.13 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 1... • https://gitlab.com/gitlab-org/gitlab/-/issues/423835 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-4912 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-4912
01 Dec 2023 — An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input. Se descubrió un problema en GitLab EE que afecta a todas las versiones desde 10.5 anteriores a 16.4.3, todas las versiones desde 16.5 anteriores a 16.5.3, todas las versiones desde 16.6 anteriores a ... • https://gitlab.com/gitlab-org/gitlab/-/issues/424882 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-5226 – Improper Control of Generation of Code ('Code Injection') in GitLab
https://notcve.org/view.php?id=CVE-2023-5226
01 Dec 2023 — An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI. Se ha descubierto un problema en GitLab que afecta a todas las versiones anteriores a 16.4.3, todas las versiones a partir de 16.5 anteriores a 16.5.3, todas las versiones a partir... • https://gitlab.com/gitlab-org/gitlab/-/issues/426400 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5963 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-5963
06 Nov 2023 — An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators. Se ha descubierto un problema en GitLab EE con Advanced Search que afecta a todas las versiones desde 13.9 a 16.3.6, 16.4 anterior a 16.4.2 y 16.5 anterior a 16.5.1 que podría permitir una denegación de servicio en la función de Advanced Search al enc... • https://gitlab.com/gitlab-org/gitlab/-/issues/423468 • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3909 – Inefficient Regular Expression Complexity in GitLab
https://notcve.org/view.php?id=CVE-2023-3909
06 Nov 2023 — An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 12.3 anteriores a 16.3.6, todas las versiones desde 16.4 anteriores a 16.4.2, todas las versiones desde 16.5 anter... • https://gitlab.com/gitlab-org/gitlab/-/issues/418763 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3246 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2023-3246
06 Nov 2023 — An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. Se ha descubierto un problema en GitLab EE/CE que afecta a todas las versiones anteriores a 16.3.6, todas las versiones desde 16.4 anteriores a 16.4.2, todas las versiones desde 16.5 anteriores a 16.5.1, lo que permite a los atacantes bloquear el procesador de trabajos... • https://gitlab.com/gitlab-org/gitlab/-/issues/415371 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5106 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2023-5106
02 Oct 2023 — An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports. Se ha descubierto un problema en Ultimate-licensed GitLab EE que afecta a todas las versiones desde 13.12 anteriores a 16.2.8, 16.3.0 anteriores a 16.3.5 y 16.4.0 anteriores a 16.4.1 y que podría permitir a un atacante hacerse pasar por usua... • https://gitlab.com/gitlab-org/gitlab/-/commit/67039cfcae80b8fc0496f79be88714873cd169b3 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •