Vulnerabilities > Gitlab > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-03-09 | CVE-2022-4317 | Open Redirect vulnerability in Gitlab Dynamic Application Security Testing Analyzer An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects. | 6.1 |
| 2023-03-09 | CVE-2022-4462 | Unspecified vulnerability in Gitlab An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. | 4.3 |
| 2023-03-08 | CVE-2022-4007 | Cross-site Scripting vulnerability in Gitlab A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side. | 6.1 |
| 2023-03-08 | CVE-2022-4315 | Incorrect Authorization vulnerability in Gitlab Dynamic Application Security Testing Analyzer An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page. | 6.5 |
| 2023-02-13 | CVE-2022-3411 | Improper Validation of Specified Quantity in Input vulnerability in Gitlab A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. | 6.5 |
| 2023-02-01 | CVE-2022-4206 | Unspecified vulnerability in Gitlab Dast API Scanner 1.6.50 A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report | 6.5 |
| 2023-01-27 | CVE-2022-4201 | Server-Side Request Forgery (SSRF) vulnerability in Gitlab A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner. | 5.3 |
| 2023-01-27 | CVE-2022-4255 | Unspecified vulnerability in Gitlab An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload. | 5.3 |
| 2023-01-27 | CVE-2022-4335 | Server-Side Request Forgery (SSRF) vulnerability in Gitlab A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host. | 4.3 |
| 2023-01-26 | CVE-2022-4054 | Unspecified vulnerability in Gitlab An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. | 5.5 |