CVE-2019-19314
https://notcve.org/view.php?id=CVE-2019-19314
05 Jan 2020 — GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. GitLab EE versiones 8.4 hasta 12.5, 12.4.3 y 12.3.6, almacenaron varios tokens en texto plano. • https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released • CWE-312: Cleartext Storage of Sensitive Information •
CVE-2019-19263
https://notcve.org/view.php?id=CVE-2019-19263
03 Jan 2020 — GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. GitLab Enterprise Edition (EE) versiones 8.2 y posteriores hasta la versíon 12.5, tiene Permisos No Seguros. • https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVE-2019-19261
https://notcve.org/view.php?id=CVE-2019-19261
03 Jan 2020 — GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF. GitLab Enterprise Edition (EE) versiones 6.7 y posteriores hasta la 12.5, permite un ataque de tipo SSRF. • https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVE-2019-19260
https://notcve.org/view.php?id=CVE-2019-19260
03 Jan 2020 — GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). GitLab Community Edition (CE) and Enterprise Edition (EE) versiones hasta la versión 12.5, tiene un Control de Acceso Incorrecto (problema 2 de 2). • https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released •
CVE-2019-19257
https://notcve.org/view.php?id=CVE-2019-19257
03 Jan 2020 — GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2). GitLab Community Edition (CE) and Enterprise Edition (EE) versiones hasta la versión 12.5, tienen un Control de Acceso Incorrecto • https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released •
CVE-2018-20494
https://notcve.org/view.php?id=CVE-2018-20494
30 Dec 2019 — An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Se descubrió un problema en GitLab Community and Enterprise Edition versiones anteriores a la versión 11.4.13, versiones 11.5.x anteriores a la versión 11.5.6 y versiones 11.6.x anteriores a la versión 11.6.1. Tiene un Control de Acceso Incorrecto. • https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released • CWE-863: Incorrect Authorization •
CVE-2018-20497
https://notcve.org/view.php?id=CVE-2018-20497
30 Dec 2019 — An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. Se descubrió un problema en GitLab Community and Enterprise Edition versiones anteriores a la versión 11.4.13, versiones 11.5.x anteriores a la versión 11.5.6 y versiones 11.6.x anteriores a la versión 11.6.1. Permite un ataque de tipo SSRF. • https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVE-2018-20492
https://notcve.org/view.php?id=CVE-2018-20492
26 Dec 2019 — An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6). Se detectó un problema en GitLab Community and Enterprise Edition versiones anteriores a 11.4.13, versiones 11.5.x anteriores a 11.5.6 y versiones 11.6.x anteriores a 11.6.1. Presenta un Control de Acceso Incorrecto (problema 2 de 6). • https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released • CWE-863: Incorrect Authorization •
CVE-2019-15584
https://notcve.org/view.php?id=CVE-2019-15584
20 Dec 2019 — A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page. Se presenta una denegación de servicio en gitlab versiones anteriores a v12.3.2, versiones anteriores a v12.2.6 y versiones anteriores a v12.1.10, que permitiría a un atacante omitir la comprobación de entrada en los campos markdown para suspender la página afectada. • https://hackerone.com/reports/670572 • CWE-400: Uncontrolled Resource Consumption •
CVE-2019-15589
https://notcve.org/view.php?id=CVE-2019-15589
18 Dec 2019 — An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before. Se presenta una vulnerabilidad de control de acceso inapropiado en Gitlab versiones anteriores a v12.3.2, versiones anteriores a v12.2.6, versiones anteriores a v12.1.12, que permitiría que un usuario bloqueado pudiera ser capaz de usar el clon GIT y extraer si hubiera obtenido un token CI/CD antes. • https://hackerone.com/reports/497047 • CWE-284: Improper Access Control •