CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10086
https://notcve.org/view.php?id=CVE-2020-10086
GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read. GitLab versiones 10.4 hasta 12.8.1, permite un Salto de Directorio. Un endpoint en particular era susceptible a una vulnerabilidad de Salto de Directorio, conllevando a una lectura de archivos arbitraria. • https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10087
https://notcve.org/view.php?id=CVE-2020-10087
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user. GitLab versiones anteriores a 12.8.2, permite una Divulgación de Información. Las imágenes de las tarjetas de identificación no estaban siendo procesadas por un proxy, causando advertencias de contenido mixto, así como un filtrado de la dirección IP del usuario. • https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10089
https://notcve.org/view.php?id=CVE-2020-10089
GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, GitLab versiones 8.11 hasta 12.8.1, permite una Denegación de Servicio cuando se usan varias funcionalidades para una petición eachother de forma recursiva. • https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html • CWE-674: Uncontrolled Recursion •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10091
https://notcve.org/view.php?id=CVE-2020-10091
GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types. GitLab versiones anteriores a 9.3 hasta 12.8.1, permite un ataque de tipo XSS. Se encontró una vulnerabilidad de tipo cross-site scripting en una vista particular relacionada con la integración de Grafana. • https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13121
https://notcve.org/view.php?id=CVE-2019-13121
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control. Se detectó un problema en GitLab Enterprise Edition versiones 10.6 hasta la versión 12.0.2. La integración del proyecto de GitHub era vulnerable a una vulnerabilidad de tipo SSRF que permitía a un atacante realizar peticiones a recursos de red local. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released • CWE-918: Server-Side Request Forgery (SSRF) •