CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2020-13330
https://notcve.org/view.php?id=CVE-2020-13330
29 Sep 2020 — An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature. Se ha detectado un problema en GitLab que afecta a versiones anteriores a 12.10.13. GitLab era vulnerable a un ataque de tipo XSS almacenado al importar la funcionalidad de proyecto Bitbucket • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13330.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-13329
https://notcve.org/view.php?id=CVE-2020-13329
29 Sep 2020 — An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature. Se ha detectado un problema en GitLab que afecta a versiones de 12.6.2 anteriores a 12.10.13. GitLab era vulnerable a un ataque de tipo XSS almacenado en la funcionalidad blob view • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13329.json • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13320
https://notcve.org/view.php?id=CVE-2020-13320
29 Sep 2020 — An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard. Se detectó un problema en GitLab versiones anteriores a 12.10.13, que permitía a un miembro del proyecto con permisos limitados visualizar el panel de seguridad del proyecto • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13320.json •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-13319
https://notcve.org/view.php?id=CVE-2020-13319
29 Sep 2020 — An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue. Se ha detectado un problema en GitLab que afecta a versiones anteriores a 13.1.2, 13.0.8 y 12.10.13. Una falta de comprobación de permisos para agregar tiempo dedicado a un problema • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13319.json • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-13296
https://notcve.org/view.php?id=CVE-2020-13296
29 Sep 2020 — An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens Se ha detectado un problema en GitLab que afecta a versiones posteriores e incluyendo a 10.7 anteriores a 13.0.14, posteriores e incluyendo a 13.1.0 anteriores a 13.1.8, posteriores e incluyendo a 13.2.0 anteriores a 13.2.6. Un Control de Acceso Inapropiado para los Tokens de Implementación • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13296.json • CWE-862: Missing Authorization •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13298
https://notcve.org/view.php?id=CVE-2020-13298
14 Sep 2020 — A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. La funcionalidad de carga de paquetes Conan no validaba correctamente los parámetros suministrados, resultando en la divulgación limitada de archivos • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13298.json •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13305
https://notcve.org/view.php?id=CVE-2020-13305
14 Sep 2020 — A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. GitLab no invalidaba el enlace de invitación al proyecto al eliminar a un usuario de un proyecto • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13305.json • CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13309
https://notcve.org/view.php?id=CVE-2020-13309
14 Sep 2020 — A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. GitLab era vulnerable a un ataque de tipo SSRF ciego por medio de la funcionalidad repository mirroring • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13309.json • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13310
https://notcve.org/view.php?id=CVE-2020-13310
14 Sep 2020 — A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.3, 13.2.3 y 13.3.1. Era posible hacer que el proceso gitlab-runner se bloqueara mediante el envío de consultas malformadas resultando en una denegación de servicio • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13310.json •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-13315
https://notcve.org/view.php?id=CVE-2020-13315
14 Sep 2020 — A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service. Se detectó una vulnerabilidad en GitLab versiones anteriores a 13.1.10, 13.2.8 y 13.3.4. La página profile activity no estaba restringiendo la cantidad de resultados que uno podía requerir, resultando potencialmente en una denegación de servicio • https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13315.json •