CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 1CVE-2019-11544
https://notcve.org/view.php?id=CVE-2019-11544
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.x, 9.x, 10.x y versiones 11.x anteriores a 11.8.9, versiones 11.9.x anteriores a 11.9.10 y versiones 11.10.x anteriores a 11.10.2. Permite la divulgación de información. • https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released https://gitlab.com/gitlab-org/gitlab-ce/issues/58372 •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-11605
https://notcve.org/view.php?id=CVE-2019-11605
An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token. Se detectó un problema en GitLab Community and Enterprise Edition versiones 11.8.x anteriores a 11.8.10, versiones 11.9.x anteriores a 11.9.11 y versiones 11.10.x anteriores a 11.10.3. Permite una Divulgación de Información. • https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 2CVE-2019-5473
https://notcve.org/view.php?id=CVE-2019-5473
An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. Se detectó un problema de autenticación en GitLab, que permitió omitir la comprobación por correo electrónico. Esto se abordó en GitLab versiones 12.1.2 y 12.0.4. • https://gitlab.com/gitlab-org/gitlab-ee/issues/11643 https://hackerone.com/reports/565883 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 2CVE-2019-5471
https://notcve.org/view.php?id=CVE-2019-5471
An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6. Se detectó un problema de comprobación de entrada y codificación de salida en la funcionalidad de notificación de correo electrónico de GitLab lo que podría resultar un ataque XSS persistente. Esto se abordó en GitLab versiones 12.1.2, 12.0.4 y 11.11.6. • https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released https://gitlab.com/gitlab-org/gitlab-ee/issues/11515 https://hackerone.com/reports/496973 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 2CVE-2019-5467
https://notcve.org/view.php?id=CVE-2019-5467
An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. Se detectó un problema de comprobación de entrada y codificación de salida en la funcionalidad de páginas wiki de GitLab CE/EE que podría resultar en un ataque de tipo XSS persistente. Esta vulnerabilidad se abordó en las versiones 12.1.2, 12.0.4 y 11.11.6. • https://gitlab.com/gitlab-org/gitlab-ce/issues/60143 https://hackerone.com/reports/526325 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •