2678 matches found
CVE-2022-2761
CVE-2022-2761 affects GitLab CE/EE and involves an information disclosure where an attacker can use GitLab Flavored Markdown (GFM) references in a Jira issue to reveal names of resources the attacker should not access. Impact applies to all versions from 14.4 up to but not including 15.3.5, 15.4 ...
CVE-2022-3706
CVE-2022-3706 affects GitLab CE/EE: improper authorization lets a user retrying a downstream job take ownership of retried upstream jobs without access to the project. Affected versions: 7.14 up to but not including 15.3.5; 15.4 up to but not including 15.4.4; 15.5 up to but not including 15.5.2....
CVE-2022-3819
An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to...
CVE-2022-3265
CVE-2022-3265 affects GitLab CE/EE. The issue is a stored cross-site scripting (XSS) vulnerability in the labels color feature, impacting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. The root cause is exploitation of the labels color setting, enabling attackers to...
CVE-2022-3726
Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account...
CVE-2022-3280
Removed by vendor...
CVE-2022-3819
CVE-2022-3819 describes an improper authorization issue in GitLab CE/EE. Affected versions are all 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, where malicious users can set emojis on internal notes they do not have access to. The description provided does not specify a p...
CVE-2022-3818
CVE-2022-3818 affects GitLab CE/EE with an uncontrolled resource consumption issue during URL parsing, impacting all versions before 15.3.5, 15.4 before 15.4.4, and 15.5 before 15.5.2. The root cause is resource consumption leading to potential DoS; remediation is upgrading to fixed versions (15....
CVE-2022-3793
GitLab CE/EE vulnerability CVE-2022-3793: improper authorization allows reading variables set in a GitLab CI/CD config file by an attacker without access. Affected: all 14.4 up to before 15.3.5; 15.4 up to before 15.4.4; 15.5 up to before 15.5.2. Root cause: insufficient access control around CI/...
CVE-2022-2761
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown GFM references in a Jira issue to disclose the names of resources they don't have access to...
CVE-2022-3483
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the...
CVE-2022-3819
Removed by vendor...
CVE-2022-3483
CVE-2022-3483 affects GitLab CE/EE: vulnerable in all versions starting from 12.1 up to 15.3.4, all 15.4.x before 15.4.4, and all 15.5.x before 15.5.2. The issue allows a malicious maintainer to exfiltrate a Datadog integration access token by altering the integration URL so that authenticated re...
CVE-2022-3793
An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...
CVE-2022-3706
Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that...
CVE-2022-3793
An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...
CVE-2022-2761
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown GFM references in a Jira issue to disclose the names of resources they don't have access to...
CVE-2022-2761
An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown GFM references in a Jira issue to disclose the names of resources they don't have access to...