CVSS: 6.5EPSS: 0%CPEs: 54EXPL: 0CVE-2017-11438
https://notcve.org/view.php?id=CVE-2017-11438
GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup. GitLab Community Edition (CE) y Enterprise Edition (EE) anteriores a la 9.0.11, 9.0.11, 9.1.8 y 9.2.8 permiten que un usuario autenticado con la capacidad para crear un grupo se añada a sí mismo en cualquier proyecto que se sitúe dentro de un subgrupo. • https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released • CWE-269: Improper Privilege Management •
CVSS: 6.3EPSS: 0%CPEs: 59EXPL: 1CVE-2017-0882
https://notcve.org/view.php?id=CVE-2017-0882
Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC. Multiples versiones de GitLab exponen credenciales de usuario confidenciales al asignar un usuario a una solicitud de emisión o de combinación. Una correción fue incluida en las versiones 8.15.8, 8.16.7 y 8.17.4, que se publicaron el 20 de marzo de 2017 a las 23:59 UTC. • http://www.securityfocus.com/bid/97157 https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1 https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5 https://gitlab.com/gitlab-org/gitlab-ce/issues/29661 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •