FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Gitlab -- Multiple Vulnerabilities

Affected packages
15.11.0 <= gitlab-ce < 15.11.1
15.10.0 <= gitlab-ce < 15.10.5
9.0 <= gitlab-ce < 15.9.6


VuXML ID 4ffcccae-e924-11ed-9c88-001b217b3468
Discovery 2023-05-02
Entry 2023-05-02

Gitlab reports:

Privilege escalation for external users when OIDC is enabled under certain conditions

Account takeover through open redirect for Group SAML accounts

Users on banned IP addresses can still commit to projects

User with developer role (group) can modify Protected branches setting on imported project and leak group CI/CD variables

The Gitlab web interface does not guarantee file integrity when downloading source code or installation packages from a tag or from a release.

Banned group member continues to have access to the public projects of a public group with the access level as same as before the ban.

The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

XSS and content injection and iframe injection when viewing raw files on iOS devices

Authenticated users can find other users by their private email


CVE Name CVE-2022-4376
CVE Name CVE-2023-0756
CVE Name CVE-2023-0805
CVE Name CVE-2023-1178
CVE Name CVE-2023-1621
CVE Name CVE-2023-1836
CVE Name CVE-2023-1965
CVE Name CVE-2023-2069
CVE Name CVE-2023-2182