Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
673 results · page 9 of 14
Jul 12, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions fCVE-2023-2620 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Jul 12, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versiCVE-2023-2576 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Jul 12, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versiCVE-2023-2200 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Jul 12, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versCVE-2023-2190 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Jul 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versiCVE-2023-1936 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-2485 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-2199 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versiCVE-2023-2198 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-2015 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versiCVE-2023-2013 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from CVE-2023-2001 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-0508 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.CVE-2023-0121 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2.CVE-2023-2442 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-2132 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticatedCVE-2023-0921 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023An issue has been discovered in GitLab CE/EE affecting only version 16.0.0.CVE-2023-2825 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 10
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versiCVE-2023-2478 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions startiCVE-2023-1178 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versCVE-2023-1204 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1.CVE-2023-0155 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable chCVE-2023-1708 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.CVE-2023-1084 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.7
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cCVE-2022-4007 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versionCVE-2023-0518 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and CVE-2022-4138 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versionCVE-2022-3759 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated aCVE-2022-3411 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2023A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addrCVE-2022-4201 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2.CVE-2022-3740 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.CVE-2022-3572 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unaCVE-2022-3482 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versionCVE-2022-2907 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2.CVE-2023-0042 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionCVE-2022-4365 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionCVE-2022-4342 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionCVE-2022-4131 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.CVE-2022-4037 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionCVE-2022-3870 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.CVE-2022-3613 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.8
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionCVE-2022-3573 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versionsCVE-2022-3514 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a maliciCVE-2022-3819 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.CVE-2022-3818 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacCVE-2022-3793 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowsCVE-2022-3726 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.8
Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying aCVE-2022-3706 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versionCVE-2022-3483 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick usCVE-2022-3280 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2.CVE-2022-3265 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.