CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2017-0923
https://notcve.org/view.php?id=CVE-2017-0923
21 Mar 2018 — Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting. Gitlab Community Edition 9.1 es vulnerable a una falta de validación de entradas en el componente IPython notebooks que resulta en Cross-Site Scripting (XSS) persistente. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2017-0924
https://notcve.org/view.php?id=CVE-2017-0924
21 Mar 2018 — Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting. Gitlab Community Edition 10.2.4 es vulnerable a una falta de validación de entradas en el componente labels que resulta en Cross-Site Scripting (XSS) persistente. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 3%CPEs: 9EXPL: 0CVE-2017-0915 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0915
18 Mar 2018 — Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. Gitlab Community Edition 10.2.4 es vulnerable a una falta de validación de entradas en GitlabProjectsImportService que resulta en la ejecución remota de código. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-0917 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0917
18 Mar 2018 — Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. Gitlab Community Edition 10.2.4 es vulnerable a una falta de validación de entradas en el componente de trabajo CI que resulta en Cross-Site Scripting (XSS) persistente. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2017-0925 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0925
18 Mar 2018 — Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password. Gitlab Enterprise Edition 10.1.0 es vulnerable a un problema de credenciales protegidas de forma insuficiente en el endpoint de API de proyecto de integración de servicio que resulta en la divulgación de información de contraseñas en texto plano. Several vulnerabilities have been discovered in Gitl... • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-319: Cleartext Transmission of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 1CVE-2017-0926 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0926
18 Mar 2018 — Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. Gitlab Community Edition 10.3 es vulnerable a un problema de autorización incorrecta en el componente Oauth sign-in que resulta en el inicio de sesión de un usuario no autorizado. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-0918 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0918
18 Mar 2018 — Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. Gitlab Community Edition 10.3 es vulnerable a un problema de salto de directorio en el componente GitLab CI runner que resulta en la ejecución remota de código. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 9.8EPSS: 3%CPEs: 7EXPL: 0CVE-2017-0916 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2017-0916
18 Mar 2018 — Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution. Gitlab Community Edition 10.3 es vulnerable a una falta de validación de entradas en la cola system_hook_push mediante el componente de enlace web que resulta en la ejecución remota de código. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 4%CPEs: 9EXPL: 0CVE-2018-3710 – Debian Security Advisory 4145-1
https://notcve.org/view.php?id=CVE-2018-3710
18 Mar 2018 — Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution. Las ediciones Community y Enterprise de Gitlab, en su versión 10.3.3, son vulnerables a un archivo temporal inseguro en el componente de importación de proyectos, lo que resulta en una ejecución remota de código. Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code. • https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-377: Insecure Temporary File •
CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2017-17716
https://notcve.org/view.php?id=CVE-2017-17716
17 Dec 2017 — GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem. GitLab en versiones 9.4.x anteriores a la 9.4.2 no es compatible con la verificación de certificados SSL LDAP, pero se mencionó la opción LDAP verify_certificates en el anuncio del lanzamiento de la versión 9.4. Es... • https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification • CWE-295: Improper Certificate Validation •