CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15732
https://notcve.org/view.php?id=CVE-2019-15732
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 12.2 hasta 12.2.1. La API de importación de proyectos podría ser usada para omitir las restricciones de visibilidad del proyecto. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15731
https://notcve.org/view.php?id=CVE-2019-15731
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 12.0 hasta 12.2.1. Los no miembros eran capaces de comentar en las peticiones de fusión a pesar de que el repositorio se configuró para permitir que solo los miembros del proyecto lo hagan. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15730
https://notcve.org/view.php?id=CVE-2019-15730
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 8.14 hasta 12.2.1. La integración de Jira contiene una vulnerabilidad de tipo SSRF como resultado d... • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15728
https://notcve.org/view.php?id=CVE-2019-15728
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 10.1 hasta 12.2.1. Las protecciones contra ataques de tipo SSRF en la integración de Kubernetes son insuficientes, lo que podría haber permitido a un ataca... • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15727
https://notcve.org/view.php?id=CVE-2019-15727
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 11.2 hasta 12.2.1. Se aplicaron comprobaciones de permisos insuficientes cuando se mostraron los resultados de CI, exponiendo potencialmente algunos datos de métricas de CI a usuarios no autorizados. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15726
https://notcve.org/view.php?id=CVE-2019-15726
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server. Se descubrió un problema en GitLab Community and Enterprise Edition versiones hasta 12.2.1. Las imágenes y los archivos multimedia insertados en Markdown podrían ser apuntados hacia un servidor arbitrario, que revelaría la dirección IP de los clientes que solic... • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15725
https://notcve.org/view.php?id=CVE-2019-15725
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 12.0 hasta 12.2.1. Un IDOR en la API de notas épicas que podría resultar en la divulgación de hitos privados, etiquetas y otra información. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15724
https://notcve.org/view.php?id=CVE-2019-15724
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 11.10 hasta 12.2.1. Las descripciones de etiquetas son vulnerables a la inyección HTML. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15723
https://notcve.org/view.php?id=CVE-2019-15723
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 11.9.x y versiones 11.10.x anteriores a 11.10.1. Las peticiones de fusión creadas por medio del correo electrónico podrían ser usadas para omitir las reglas de inserción en ciertas situaciones. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15722
https://notcve.org/view.php?id=CVE-2019-15722
16 Sep 2019 — An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources. Se descubrió un problema en GitLab Community and Enterprise Edition versiones 8.15 hasta 12.2.1. Las expresiones matemáticas particulares en GitLab Markdown pueden agotar los recursos del cliente. • https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released • CWE-770: Allocation of Resources Without Limits or Throttling •