git: bfcf8db918c9 - main - security/vuxml: Document gitlab-ce vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 03 Mar 2023 19:53:54 UTC
The branch main has been updated by mfechner:
URL: https://cgit.FreeBSD.org/ports/commit/?id=bfcf8db918c938804d938358e4a7c7727ad7f556
commit bfcf8db918c938804d938358e4a7c7727ad7f556
Author: Matthias Fechner <mfechner@FreeBSD.org>
AuthorDate: 2023-03-03 19:53:11 +0000
Commit: Matthias Fechner <mfechner@FreeBSD.org>
CommitDate: 2023-03-03 19:53:11 +0000
security/vuxml: Document gitlab-ce vulnerabilities
---
security/vuxml/vuln/2023.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index 11478535c90e..7713a74039f7 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,51 @@
+ <vuln vid="f7c5b3a9-b9fb-11ed-99c6-001b217b3468">
+ <topic>Gitlab -- Multiple Vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>gitlab-ce</name>
+ <range><ge>15.9.0</ge><lt>15.9.2</lt></range>
+ <range><ge>15.8.0</ge><lt>15.8.4</lt></range>
+ <range><ge>9.0.0</ge><lt>15.7.8</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Gitlab reports:</p>
+ <blockquote cite="https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/">
+ <p>Stored XSS via Kroki diagram</p>
+ <p>Prometheus integration Google IAP details are not hidden, may leak account details from instance/group/project settings</p>
+ <p>Improper validation of SSO and SCIM tokens while managing groups</p>
+ <p>Maintainer can leak Datadog API key by changing Datadog site</p>
+ <p>Clipboard based XSS in the title field of work items</p>
+ <p>Improper user right checks for personal snippets</p>
+ <p>Release Description visible in public projects despite release set as project members only</p>
+ <p>Group integration settings sensitive information exposed to project maintainers</p>
+ <p>Improve pagination limits for commits</p>
+ <p>Gitlab Open Redirect Vulnerability</p>
+ <p>Maintainer may become an Owner of a project</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-0050</cvename>
+ <cvename>CVE-2022-4289</cvename>
+ <cvename>CVE-2022-4331</cvename>
+ <cvename>CVE-2023-0483</cvename>
+ <cvename>CVE-2022-4007</cvename>
+ <cvename>CVE-2022-3758</cvename>
+ <cvename>CVE-2023-0223</cvename>
+ <cvename>CVE-2022-4462</cvename>
+ <cvename>CVE-2023-1072</cvename>
+ <cvename>CVE-2022-3381</cvename>
+ <cvename>CVE-2023-1084</cvename>
+ <url>https://about.gitlab.com/releases/2023/03/02/security-release-gitlab-15-9-2-released/</url>
+ </references>
+ <dates>
+ <discovery>2023-03-02</discovery>
+ <entry>2023-03-03</entry>
+ </dates>
+ </vuln>
+
<vuln vid="6dccc186-b824-11ed-b695-6c3be5272acd">
<topic>Grafana -- Stored XSS in text panel plugin</topic>
<affects>