CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13301
https://notcve.org/view.php?id=CVE-2020-13301
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. GitLab era vulnerable a un ataque de tipo XSS almacenado en la página standalone vulnerability • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13301.json https://gitlab.com/gitlab-org/gitlab/-/issues/219378 https://hackerone.com/reports/882988 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13302
https://notcve.org/view.php?id=CVE-2020-13302
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. Bajo determinadas condiciones, GitLab no revocaba apropiadamente las sesiones de usuarios y permitía a un usuario malicioso acceder a una cuenta de usuario con una contraseña antigua • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13302.json https://gitlab.com/gitlab-org/gitlab/-/issues/25195 https://hackerone.com/reports/437194 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13297
https://notcve.org/view.php?id=CVE-2020-13297
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. Cuando era habilitada la autenticación de 2 factores para grupos, un usuario malicioso podría omitir esa restricción mediante el envío de una consulta específica hacia el endpoint de la API • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13297.json https://gitlab.com/gitlab-org/gitlab/-/issues/32215 https://hackerone.com/reports/691592 •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13304
https://notcve.org/view.php?id=CVE-2020-13304
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. El mismo código secreto de autenticación de 2 factores era generado, lo que resultaba en que un atacante mantuviera el acceso bajo determinadas condiciones • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13304.json https://gitlab.com/gitlab-org/gitlab/-/issues/27686 https://hackerone.com/reports/511260 • CWE-330: Use of Insufficiently Random Values •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13314
https://notcve.org/view.php?id=CVE-2020-13314
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. El endpoint Omniauth de GitLab permitió a un usuario malicioso enviar contenido para ser mostrado al usuario dentro de los mensajes de error • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13314.json https://gitlab.com/gitlab-org/gitlab/-/issues/25201 https://hackerone.com/reports/438746 •