FreeBSD: VID-43f84437-73ab-11ec-a587-001b217b3468 (CVE-2022-0093): Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary file read via group import feature Stored XSS in notes Lack of state parameter on GitHub import project OAuth Vulnerability related fields are available to unauthorized users on GraphQL API Deleting packages may cause table locks IP restriction bypass via GraphQL Repository content spoofing using Git replacement references Users can import members from projects that they are not a maintainer on through API Possibility to direct user to malicious site through Slack integration Bypassing file size limits to the NPM package repository User with expired password can still access sensitive information Incorrect port validation allows access to services on ports 80 and 443 if GitLab is configured to run on another port