CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11000
https://notcve.org/view.php?id=CVE-2019-11000
An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure. Se descubrió un problema en GitLab Enterprise Edition antes de la versión 11.7.11, 11.8.x anterior a la versión 11.8.7, y 11.9.x anterior a 11.9.7. Permite la Divulgación de Información. • http://www.securityfocus.com/bid/108301 https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released https://about.gitlab.com/blog/categories/releases •
CVSS: 6.1EPSS: 0%CPEs: 32EXPL: 0CVE-2018-18643
https://notcve.org/view.php?id=CVE-2018-18643
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. GitLab CE & EE versiones posteriores a 11.2 y anteriores a 11.5.0-rc12, 11.4.6 y 11.3.10 tienen Cross-site scripting (XSS) persistente. • https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released https://about.gitlab.com/blog/categories/releases https://gitlab.com/gitlab-org/gitlab-ce/issues/53385 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10301
https://notcve.org/view.php?id=CVE-2019-10301
A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una falta de comprobación de permisos en Jenkins GitLab Plugin versión 1.5.11 y anteriores, en el método de validación de formulario GitLabConnectionConnectionConfig#doTestConnection permitió a los atacantes con permiso Overall/Read conectarse a una URL especificada por el atacante, utilizando ID de credenciales especificadas por el atacante, y que fueron obtenidas por otro método, capturando las credenciales almacenadas en Jenkins. • http://www.securityfocus.com/bid/108045 https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357 • CWE-862: Missing Authorization •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10300
https://notcve.org/view.php?id=CVE-2019-10300
A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una vulnerabilidad de tipo cross-site request forgery en el Plugin GitLab de Jenkins versión 1.5.11 y anteriores en el método de validación del formulario GitLabConnectionConfig#doTestConnection permitió a los atacantes conectarse a una URL especificada por el atacante utilizando las ID de credenciales especificadas por el atacante obtenidas por medio de otro método, capturando credenciales almacenadas en Jenkins • http://www.securityfocus.com/bid/108045 https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357 https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0788 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2019-9220
https://notcve.org/view.php?id=CVE-2019-9220
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption. Se descubrió un problema en GitLab Community and Enterprise Edition antes de 11.6.10, 11.7.x antes de 11.7.6 y 11.8.x antes de 11.8.1. Permite el consumo de recursos no controlados. • https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released https://about.gitlab.com/blog/categories/releases https://gitlab.com/gitlab-org/gitlab-ce/issues/55653 • CWE-400: Uncontrolled Resource Consumption •