CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 1CVE-2019-11549
https://notcve.org/view.php?id=CVE-2019-11549
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors. Se detectó un problema en GitLab Community and Enterprise Edition versiones 9.x, 10.x y versiones 11.x anteriores a 11.8.9, versiones 11.9.x anteriores a 11.9.10 y versiones 11.10.x anteriores a 11.10.2. Gitaly permite un problema de divulgación de información en el que las credenciales HTTP/GIT son incluidas en los registros de errores de conexión. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ce/issues/57779 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2019-11548
https://notcve.org/view.php?id=CVE-2019-11548
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint. Se detectó un problema en GitLab Community and Enterprise Edition versiones anteriores a 11.8.9. Presenta un Control de Acceso Incorrecto. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ce/issues/58505 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 1CVE-2019-11547
https://notcve.org/view.php?id=CVE-2019-11547
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues. Se detectó un problema en GitLab Community and Enterprise Edition versiones anteriores a 11.8.9, versiones 11.9.x anteriores a 11.9.10 y versiones 11.10.x anteriores a 11.10.2. Presenta una Codificación Incorrecta o un Escape de Salida. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ee/issues/11515 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2019-11546
https://notcve.org/view.php?id=CVE-2019-11546
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge. Se detectó un problema en GitLab Community and Enterprise Edition versiones anteriores a 11.8.9, versiones 11.9.x anteriores a 11.9.10 y versiones 11.10.x anteriores a 11.10.2. Presenta una condición de carrera que podría permitir a usuarios aprobar una petición de fusión varias veces y potencialmente alcanzar el conteo de aprobación requerido para fusionarse. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ee/issues/10357 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2019-11545
https://notcve.org/view.php?id=CVE-2019-11545
An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue. Se detectó un problema en GitLab Community Edition versiones 11.9.x anteriores a 11.9.10 y versiones 11.10.x anteriores a 11.10.2. Permite la divulgación de información. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ce/issues/58939 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •