Page 72 of 370 results (0.004 seconds)

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-8540

https://notcve.org/view.php?id=CVE-2014-8540

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks. La API de grupos en GitLab 6.x y 7.x anteriores a la 7.4.3 permite que los usuarios guest autenticados remotos modifiquen la propiedad de grupos arbitrarios aprovechándose de las comprobaciones incorrectas de permisos. • http://www.openwall.com/lists/oss-security/2014/10/31/2 http://www.securityfocus.com/bid/70841 https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released https://exchange.xforce.ibmcloud.com/vulnerabilities/98449 https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 1%CPEs: 96EXPL: 1

CVE-2017-12426

https://notcve.org/view.php?id=CVE-2017-12426

GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import. GitLab Community Edition (CE) y Enterprise Edition (EE) en versiones anteriores a la 8.17.8, 9.0.x en versiones anteriores a la 9.0.13, 9.1.x en versiones anteriores a la 9.1.10, 9.2.x en versiones anteriores a la 9.2.10, 9.3.x en versiones anteriores a la 9.3.10, y 9.4.x en versiones anteriores a la 9.4.4 podría permitir que atacantes remotos ejecuten código arbitrario mediante una URL SSH manipulada en una importación de proyecto. • https://github.com/sm-paul-schuette/CVE-2017-12426 https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 0%CPEs: 175EXPL: 0

CVE-2017-11437

https://notcve.org/view.php?id=CVE-2017-11437

GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users. GitLab Enterprise Edition (EE) en sus versiones anteriores a la 8.17.7 y las versiones 9.0.11, 9.1.8, 9.2.8 y 9.3.8 permite que un usuario autenticado con la capacidad para crear un proyecto utilice la función de replicación para poder acceder a repositorios de otros usuarios. • https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 1

CVE-2017-8778

https://notcve.org/view.php?id=CVE-2017-8778

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document. GitLab anteriores a 8.14.9, 8.15.x anteriores a 8.15.6 y 8.16.x anteriores a 8.16.5 tienen XSS a través de un elemento SCRIPT en un archivo adjunto o un avatar que es un documento SVG. • https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release https://gitlab.com/gitlab-org/gitlab-ce/issues/27471 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.3EPSS: 0%CPEs: 59EXPL: 1

CVE-2017-0882

https://notcve.org/view.php?id=CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC. Multiples versiones de GitLab exponen credenciales de usuario confidenciales al asignar un usuario a una solicitud de emisión o de combinación. Una correción fue incluida en las versiones 8.15.8, 8.16.7 y 8.17.4, que se publicaron el 20 de marzo de 2017 a las 23:59 UTC. • http://www.securityfocus.com/bid/97157 https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1 https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5 https://gitlab.com/gitlab-org/gitlab-ce/issues/29661 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •