CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13293
https://notcve.org/view.php?id=CVE-2020-13293
In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash. En GitLab versiones anteriores a 13.0.12, 13.1.6 y 13.2.3, el uso de una rama con un nombre hexadecimal podría anular un hash existente • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13293.json https://gitlab.com/gitlab-org/gitlab/-/issues/202690 https://hackerone.com/reports/790634 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15525
https://notcve.org/view.php?id=CVE-2020-15525
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint. GitLab EE versiones 11.3 hasta 13.1.2, presenta un Control de Acceso Incorrecto debido al endpoint de carga del paquete Maven • https://about.gitlab.com/releases/2020/07/06/critical-security-release-gitlab-13-1-3-released https://about.gitlab.com/releases/categories/releases https://gitlab.com/gitlab-org/gitlab/-/issues/225259 •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13279
https://notcve.org/view.php?id=CVE-2020-13279
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system Una ejecución de código del lado del cliente en gitlab-vscode-extension versión v2.2.0, permite al atacante ejecutar código sobre el sistema del usuario • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13279.json https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/170 • CWE-427: Uncontrolled Search Path Element •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13263
https://notcve.org/view.php?id=CVE-2020-13263
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions. Se identificó un problema de autorización relacionado con la suplantación del mantenedor del proyecto en GitLab EE versiones 9.5 y posteriores hasta 13.0.1, que podría permitir a usuarios no autorizados hacerse pasar como mantenedor para llevar a cabo acciones limitadas • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.json https://gitlab.com/gitlab-org/gitlab/-/issues/211940 https://hackerone.com/reports/819821 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13264
https://notcve.org/view.php?id=CVE-2020-13264
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token Una divulgación de token del clúster de Kubernetes en GitLab CE/EE versiones 10.3 y posteriores hasta 13.0.1, permite que otros mantenedores de grupo visualicen el token del clúster de Kubernetes • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13264.json https://gitlab.com/gitlab-org/gitlab/-/issues/55302 https://hackerone.com/reports/702796 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •