VulnerableCode Package Details - pkg:alpm/archlinux/gitlab@15.2.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-1t9u-drzk-5ffz Aliases: CVE-2022-2500	A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-3szm-mdpf-6ua7 Aliases: CVE-2022-2534	An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-92x8-rmhg-zuh6 Aliases: CVE-2022-2326	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-9cvy-mzhc-ukhu Aliases: CVE-2022-2497	An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-hd2f-p7zx-vqcp Aliases: CVE-2022-2512	An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-hfyr-23g4-y7e5 Aliases: CVE-2022-2095	An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-mbnw-5r9b-mybe Aliases: CVE-2022-2539	An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-mrtq-9dj4-a7bf Aliases: CVE-2022-2307	A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-tv9d-9wvu-rfdg Aliases: CVE-2022-2303	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-tzw9-uffa-9ycy Aliases: CVE-2022-2417	Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.	15.2.1-1 Affected by 0 other vulnerabilities.
VCID-wyff-62y3-9qdq Aliases: CVE-2022-2456	An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.	15.2.1-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1t9u-drzk-5ffz
Aliases:
CVE-2022-2500

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.