CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-13001
https://notcve.org/view.php?id=CVE-2019-13001
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass. Se detectó un problema en GitLab Community and Enterprise Edition versiones 11.9 y posteriores hasta 12.0.2. GitLab Snippets eran vulnerables a un problema de autorización que permitía a usuarios no autorizados agregar comentarios a un fragmento privado... • https://about.gitlab.com/blog/categories/releases • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12446
https://notcve.org/view.php?id=CVE-2019-12446
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.3 hasta 11.11. Permite una Exposición de la Información por medio de un Mensaje de Error. • https://about.gitlab.com/blog/categories/releases • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12445
https://notcve.org/view.php?id=CVE-2019-12445
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.4 hasta 11.11. Un usuario malicioso podría ejecutar código JavaScript en unas notas al importar un archivo de proyecto especialmente diseñado. • https://about.gitlab.com/blog/categories/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12444
https://notcve.org/view.php?id=CVE-2019-12444
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. Se ha detectado un problema en GitLab Community and Enterprise Edition versiones 8.9 hasta 11.11. Unas Páginas Wiki contenían una falta de comprobación de entrada que resultó en una vulnerabilidad de tipo XSS persistente. • https://about.gitlab.com/blog/categories/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12443
https://notcve.org/view.php?id=CVE-2019-12443
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks. Se detectó un problema en GitLab Community and Enterprise Edition versiones 10.2 hasta 11.11. Múltiples funcionalidades contenían vulnerabilidades de tipo Server-Side Request Forgery (SSRF) causadas por una comprobación insuficiente para impedir ataques de tipo DNS rebinding... • https://about.gitlab.com/blog/categories/releases • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12442
https://notcve.org/view.php?id=CVE-2019-12442
10 Mar 2020 — An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics. Se detectó un problema en GitLab Enterprise Edition versiones 11.7 hasta 11.11. La página epic details contenía una falta de comprobación de entrada y un problema de codificación de salida que resultó en una vulnerabilidad de tipo XSS persistente sobre child epics. • https://about.gitlab.com/blog/categories/releases • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12441
https://notcve.org/view.php?id=CVE-2019-12441
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.4 hasta 11.11. La funcionalidad de sucursales protegidas contenían un problema de control de acceso que resultó en la omisión de las reglas de restricción de sucursales protegidas... • https://about.gitlab.com/blog/categories/releases • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12434
https://notcve.org/view.php?id=CVE-2019-12434
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure. Se detectó un problema en GitLab Community and Enterprise Edition versiones 10.6 hasta 11.11. Unos usuarios podían adivinar el URL slug de proyectos privados por medio del contraste de las URL de destino de los temas vinculados en los comentarios. • https://about.gitlab.com/blog/categories/releases • CWE-330: Use of Insufficiently Random Values •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12433
https://notcve.org/view.php?id=CVE-2019-12433
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues. Se detectó un problema en GitLab Community and Enterprise Edition versiones 11.7 hasta 11.11. Tiene una Comprobación de Entrada Inapropiada. • https://about.gitlab.com/blog/categories/releases • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-12432
https://notcve.org/view.php?id=CVE-2019-12432
10 Mar 2020 — An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure. Se detectó un problema en GitLab Community and Enterprise Edition versiones 8.13 hasta 11.11. Permite una Divulgación de Información. • https://about.gitlab.com/blog/categories/releases • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •