CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15728
https://notcve.org/view.php?id=CVE-2019-15728
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 10.1 hasta 12.2.1. Las protecciones contra ataques de tipo SSRF en la integración de Kubernetes son insuficientes, lo que podría haber permitido a un ataca... • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15727
https://notcve.org/view.php?id=CVE-2019-15727
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 11.2 hasta 12.2.1. Se aplicaron comprobaciones de permisos insuficientes cuando se mostraron los resultados de CI, exponiendo potencialmente algunos datos de métricas de CI a usuarios no autorizados. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15726
https://notcve.org/view.php?id=CVE-2019-15726
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server. Se descubrió un problema en GitLab Community and Enterprise Edition versiones hasta 12.2.1. Las imágenes y los archivos multimedia insertados en Markdown podrían ser apuntados hacia un servidor arbitrario, que revelaría la dirección IP de los clientes que solic... • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15722
https://notcve.org/view.php?id=CVE-2019-15722
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 8.15 hasta 12.2.1. Las expresiones matemáticas particulares en GitLab Markdown pueden agotar los recursos del cliente. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15721
https://notcve.org/view.php?id=CVE-2019-15721
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 10.8 hasta 12.2.1. Un end point interno permitió involuntariamente a los mantenedores del grupo visualizar y editar la configuración del ejecutor de grupo. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-6791
https://notcve.org/view.php?id=CVE-2019-6791
09 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility. Se descubrió un problema en GitLab Community and Enterprise Edition versiones anteriores a 11.5.8, versiones 11.6.x anteriores a 11.6.6 y versiones 11.7.x anteriores a 11.7.1. Este presenta un Control de Acceso Inco... • https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released • CWE-281: Improper Preservation of Permissions •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 1CVE-2019-7176
https://notcve.org/view.php?id=CVE-2019-7176
09 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 8.x (a partir de 8.9), 9.x, 10.xy versiones 11.x anteriores a 11.5.9, versiones 11.6.x anteriores a 11.6.7 y versiones 11.7.x anteriores a... • https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 1CVE-2019-6997
https://notcve.org/view.php?id=CVE-2019-6997
09 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles. Se detectó un problema en GitLab Community and Enterprise Edition versiones 10.x (a partir de la 10.7) y versiones 11.x anteriores a 11.5.8, versiones 11.6.x anteriores a 11.6.6 y versiones 11.7.x anteriores a 11.7.... • https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2019-6996
https://notcve.org/view.php?id=CVE-2019-6996
09 Sep 2019 — An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups. Se detectó un problema en GitLab Enterprise Edition versiones 10.x (a partir de la 10.6) y versiones 11.x anteriores a 11.5.8, versiones 11.6.x anteriores a 11.6.6 y versiones 11.7.x anteriores a... • https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 1CVE-2019-6995
https://notcve.org/view.php?id=CVE-2019-6995
09 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues. Se detectó un problema en GitLab Community and Enterprise Edition 8.x, 9.x, 10.xy versiones 11.x anteriores a 11.5.8, versiones 11.6.x anteriores a 11.6.6 y versiones 11.7.x anteriores a 11.7.1. Presenta un Control de Acceso Incorrecto. • https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released • CWE-281: Improper Preservation of Permissions •