Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26301 State: PUBLISHED Published: 2021-09-20T19:40:12 Last Updated: 2024-08-04T15:56:04.459Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: mscdex Products: ssh2 Problem Types: CWE-78 Description: ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mscdex/ssh2/commit/f763271f41320e7
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21 - https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/ - https://www.npmjs.com/package/ssh2
CVE ID: CVE-2020-26302 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T14:37:16.925Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: arasatasaygin Products: is.js Problem Types: CWE-400 Description: is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for th
vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.js - https://github.com/arasatasaygin/is.js/issues/320
CVE ID: CVE-2020-26303 State: PUBLISHED Published: 2024-10-26T20:26:09.544Z Last Updated: 2024-10-28T14:59:29.124Z Vendors: bevacqua Products: insane Problem Types: CWE-1333 Description: insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane/ - https://github.com/bevacqua/insane/issues/19
CVE ID: CVE-2020-26304 State: PUBLISHED Published: 2024-10-26T20:26:12.868Z Last Updated: 2024-10-28T14:56:44.624Z Vendors: foundation Products: foundation-sites Problem Types: CWE-1333 Description: Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-290-redos-foundation-sites/ - https://github.com/foundation/foundation-sites/issues/12180
CVE ID: CVE-2020-26305 State: PUBLISHED Published: 2024-10-26T20:26:16.039Z Last Updated: 2024-10-28T14:52:45.497Z Vendors: talyssonoc Products: CommonRegexJS Problem Types: CWE-1333 Description: CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-291-redos-CommonRegexJS/ - https://github.com/talyssonoc/CommonRegexJS/issues/4
CVE ID: CVE-2020-26306 State: PUBLISHED Published: 2024-10-26T20:26:19.170Z Last Updated: 2024-10-28T14:50:27.620Z Vendors: benhmoore Products: Knwl Problem Types: CWE-1333 Description: Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js/ - https://github.com/benhmoore/Knwl/issues/106
CVE ID: CVE-2020-26307 State: PUBLISHED Published: 2024-10-26T20:26:22.379Z Last Updated: 2024-10-28T14:48:11.164Z Vendors: kates Products: html2markdown Problem Types: CWE-1333 Description: HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-301-redos-HTML2Markdown/ - https://github.com/kates/html2markdown/issues/13
CVE ID: CVE-2020-26308 State: PUBLISHED Published: 2024-10-26T20:26:25.628Z Last Updated: 2024-10-28T14:45:43.110Z Vendors: ansman Products: validate.js Problem Types: CWE-1333 Description: Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js/ - https://github.com/ansman/validate.js/issues/342
CVE ID: CVE-2020-26309 State: PUBLISHED Published: 2024-10-26T20:26:28.746Z Last Updated: 2024-10-28T14:18:10.390Z Vendors: ftonato Products: nope-validator Problem Types: CWE-1333 Description: Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-303-redos-nope-validator/ - https://github.com/ftonato/nope-validator/issues/352
CVE ID: CVE-2020-26310 State: PUBLISHED Published: 2024-10-26T20:26:31.905Z Last Updated: 2024-10-28T14:15:10.274Z Vendors: blowsie Products: Pure-JavaScript-HTML5-Parser Problem Types: CWE-1333 Description: Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-305-redos-Pure-JavaScript-HTML5-Parser/ - https://github.com/blowsie/Pure-JavaScript-H
b.github.com/advisories/GHSL-2020-305-redos-Pure-JavaScript-HTML5-Parser/ - https://github.com/blowsie/Pure-JavaScript-HTML5-Parser/issues/14
CVE ID: CVE-2020-26311 State: PUBLISHED Published: 2024-10-26T20:26:35.087Z Last Updated: 2024-10-28T13:42:18.048Z Vendors: 3rd-Eden Products: useragent Problem Types: CWE-1333 Description: Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent/ - https://github.com/3rd-Eden/useragent/issues/167
CVE ID: CVE-2020-26312 State: PUBLISHED Published: 2024-05-14T20:22:04.485Z Last Updated: 2024-08-04T15:56:04.289Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: dotmesh-io Products: dotmesh Problem Types: CWE-787, CWE-125 Description: Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. The routine `untarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted
ntarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted to. However, a malicious tarball first linking `subdir/parent` to `..` (allowed, because `subdir/..` falls within the archive root) and then linking `subdir/parent/escapes` to `..` results in a symbolic link pointing to the tarball’s parent directory, contrary to the routine’s goals. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process h
the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process has permissions to read. As of time of publication, no patch for this issue is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2020-254-zipslip-dotmesh/ - https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255
CVE ID: CVE-2020-26313 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26314 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26315 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26316 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26317 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26318 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26319 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26320 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26321 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26322 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26323 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26324 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26325 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26326 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26327 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26328 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26329 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26330 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26331 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26332 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26333 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26334 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26335 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26336 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26337 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26338 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26339 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26340 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26341 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26342 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26343 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26344 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26345 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26346 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26347 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26348 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26349 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26350 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26351 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26352 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26353 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26354 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26355 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26356 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26357 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26358 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26359 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26360 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26361 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26362 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26363 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26364 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26365 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26366 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26367 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26368 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26369 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26370 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26371 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26372 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26373 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26374 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26375 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26376 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26377 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26378 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26379 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26380 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26381 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26382 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26383 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26384 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26385 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26386 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26387 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26388 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26389 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26390 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26391 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26392 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26393 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26394 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26395 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26396 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26397 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26398 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26399 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26400 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26401 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26402 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26403 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26404 State: REJECTED Published: N/A Last Updated: 2022-12-02T00:00:00 Description: No description available.
CVE ID: CVE-2020-26405 State: PUBLISHED Published: 2020-11-17T18:26:50 Last Updated: 2024-08-04T15:56:04.586Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: GitLab Products: GitLab CE/EE Problem Types: Improper limitation of a pathname to a restricted directory ('path traversal') in GitLab Description: Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/247371 - https://hackeron
st Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/247371 - https://hackerone.com/reports/835427 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26405.json
CVE ID: CVE-2020-26406 State: PUBLISHED Published: 2020-11-17T00:13:19 Last Updated: 2024-08-04T15:56:04.397Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab EE Problem Types: Information exposure in GitLab EE Description: Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2. Additional Analyst Notes: - CVE Program Container: References: - https:/
=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/244921 - https://hackerone.com/reports/965602 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26406.json
CVE ID: CVE-2020-26407 State: PUBLISHED Published: 2020-12-10T05:16:24 Last Updated: 2024-08-04T15:56:04.267Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GitLab Products: Gitlab CE/EE Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212630 - https://hackerone.c
Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212630 - https://hackerone.com/reports/832117 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json