CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13315
https://notcve.org/view.php?id=CVE-2020-13315
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. La página profile activity no estaba restringiendo la cantidad de resultados que uno podía requerir, resultando potencialmente en una denegación de servicio • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13315.json https://gitlab.com/gitlab-org/gitlab/-/issues/25825 https://hackerone.com/reports/463010 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13306
https://notcve.org/view.php?id=CVE-2020-13306
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. La funcionalidad Webhook de GitLab podría ser abusada para llevar a cabo ataques de denegación de servicio debido a una falta de limitación de velocidad • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13306.json https://gitlab.com/gitlab-org/gitlab/-/issues/223681 https://hackerone.com/reports/904134 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13301
https://notcve.org/view.php?id=CVE-2020-13301
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. GitLab era vulnerable a un ataque de tipo XSS almacenado en la página standalone vulnerability • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13301.json https://gitlab.com/gitlab-org/gitlab/-/issues/219378 https://hackerone.com/reports/882988 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13302
https://notcve.org/view.php?id=CVE-2020-13302
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. Bajo determinadas condiciones, GitLab no revocaba apropiadamente las sesiones de usuarios y permitía a un usuario malicioso acceder a una cuenta de usuario con una contraseña antigua • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13302.json https://gitlab.com/gitlab-org/gitlab/-/issues/25195 https://hackerone.com/reports/437194 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13297
https://notcve.org/view.php?id=CVE-2020-13297
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. Cuando era habilitada la autenticación de 2 factores para grupos, un usuario malicioso podría omitir esa restricción mediante el envío de una consulta específica hacia el endpoint de la API • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13297.json https://gitlab.com/gitlab-org/gitlab/-/issues/32215 https://hackerone.com/reports/691592 •