CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12446
https://notcve.org/view.php?id=CVE-2019-12446
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.3 hasta 11.11. Permite una Exposición de la Información por medio de un Mensaje de Error. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12445
https://notcve.org/view.php?id=CVE-2019-12445
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.4 hasta 11.11. Un usuario malicioso podría ejecutar código JavaScript en unas notas al importar un archivo de proyecto especialmente diseñado. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12444
https://notcve.org/view.php?id=CVE-2019-12444
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. Se ha detectado un problema en GitLab Community and Enterprise Edition versiones 8.9 hasta 11.11. Unas Páginas Wiki contenían una falta de comprobación de entrada que resultó en una vulnerabilidad de tipo XSS persistente. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12441
https://notcve.org/view.php?id=CVE-2019-12441
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.4 hasta 11.11. La funcionalidad de sucursales protegidas contenían un problema de control de acceso que resultó en la omisión de las reglas de restricción de sucursales protegidas. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12434
https://notcve.org/view.php?id=CVE-2019-12434
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure. Se detectó un problema en GitLab Community and Enterprise Edition versiones 10.6 hasta 11.11. Unos usuarios podían adivinar el URL slug de proyectos privados por medio del contraste de las URL de destino de los temas vinculados en los comentarios. • https://about.gitlab.com/blog/categories/releases https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released • CWE-330: Use of Insufficiently Random Values •