Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13238 State: PUBLISHED Published: 2020-06-10T19:53:01 Last Updated: 2024-08-04T12:11:19.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdf - http://jvn.jp/vu/JVNVU97662844/index.html - https://www.us-cert.gov/ics
com/en/psirt/vulnerability/pdf/2020-001_en.pdf - http://jvn.jp/vu/JVNVU97662844/index.html - https://www.us-cert.gov/ics/advisories/icsa-20-161-02
CVE ID: CVE-2020-13239 State: PUBLISHED Published: 2020-05-20T14:57:38 Last Updated: 2024-08-04T12:11:19.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.dubget.com/stored-xss-via-file-upload.html
CVE ID: CVE-2020-13240 State: PUBLISHED Published: 2020-05-20T14:57:22 Last Updated: 2024-08-04T12:11:19.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.dubget.com/stored-xss-via-file-upload.html
CVE ID: CVE-2020-13241 State: PUBLISHED Published: 2020-05-20T18:53:38 Last Updated: 2024-08-04T12:11:19.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/virendratiwari03/0af29841fdf27207eb3abc8f28d326f3
CVE ID: CVE-2020-13245 State: PUBLISHED Published: 2020-05-28T18:06:42 Last Updated: 2024-08-04T12:11:19.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P. Additional Analyst Notes: - CVE Program Container: References: - https://www.netgear.com/about/security/ - https://iot-lab-fh-ooe.github.io/netgear_update_vulnerability/
CVE ID: CVE-2020-13246 State: PUBLISHED Published: 2020-05-20T17:04:20 Last Updated: 2024-08-04T12:11:19.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/issues/10549 - https://github.com/go-gitea/gitea/pull/11438 - https://www.youtube.com/watch?v=DmVgADSVS88
CVE ID: CVE-2020-13247 State: PUBLISHED Published: 2020-06-24T19:33:27 Last Updated: 2024-08-04T12:11:19.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area. Additional Analyst Notes: - CVE Program Container: References: - https://members.backbox.org/boolebox-secure-sharing-multiple-vulnerabilities/ - https://app.boolebox.com/release/vulnerabilities/CVE-2020-13247-13248.html
CVE ID: CVE-2020-13248 State: PUBLISHED Published: 2020-06-24T18:36:08 Last Updated: 2024-08-04T12:11:19.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://members.backbox.org/boolebox-secure-sharing-multiple-vulnerabilities/ - https://app.boolebox.com/release/vulnerabilities/CVE-2020-13247-13248.html
CVE ID: CVE-2020-13249 State: PUBLISHED Published: 2020-05-20T18:48:12 Last Updated: 2024-08-04T12:11:19.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945 - https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1
ommit/2759b87d72926b7c9b5426437a7c8dd15ff57945 - https://github.com/mariadb-corporation/mariadb-connector-c/compare/v3.1.7...v3.1.8 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00064.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/
CVE ID: CVE-2020-13250 State: PUBLISHED Published: 2020-06-11T19:16:12 Last Updated: 2024-08-04T12:11:19.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/pull/8023 - https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md - https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
CVE ID: CVE-2020-13252 State: PUBLISHED Published: 2020-05-21T03:35:00 Last Updated: 2024-08-04T12:11:19.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page. Additional Analyst Notes: - CVE Program Container: References: - https://engindemirbilek.github.io/centreon-19.10-rce - https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html - https://github.com/centreon/centreon/pull/8467 - https:/
EnginDemirbilek.github.io/blob/master/centreon-19.10-rce.html - https://github.com/centreon/centreon/pull/8467 - https://github.com/centreon/centreon/compare/19.04.13...19.04.15
CVE ID: CVE-2020-13253 State: PUBLISHED Published: 2020-05-27T14:09:55 Last Updated: 2024-08-04T12:11:19.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html - http://www.openwall.com/lists/oss-security/2020/05/27/2 - https://bugzilla.redhat.com/show_bug.cgi?id=1838546 - https://usn.ubuntu.com/4467-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html -
.cgi?id=1838546 - https://usn.ubuntu.com/4467-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html - https://security.gentoo.org/glsa/202011-09 - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-13254 State: PUBLISHED Published: 2020-06-03T13:11:57 Last Updated: 2024-08-04T12:11:19.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4381-1/ - https://usn.ubuntu.com/4381-2/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00016.html - https://www.debian.org/security/2020/dsa-4705 - https://lists.fedoraproject.org/archives/list/packa
0/06/msg00016.html - https://www.debian.org/security/2020/dsa-4705 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/ - https://www.oracle.com/security-alerts/cpujan2021.html - https://docs.djangoproject.com/en/3.0/releases/security/ - https://groups.google.com/d/msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ - https://www.djangoproject.com/weblog/2020/jun/03/security-releases/ - https://security.netapp.com/advisory/ntap-20200611-0002/
CVE ID: CVE-2020-13258 State: PUBLISHED Published: 2020-05-21T16:06:52 Last Updated: 2024-08-04T12:11:19.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contentful/the-example-app.py/issues/44
CVE ID: CVE-2020-13259 State: PUBLISHED Published: 2020-09-16T18:27:44 Last Updated: 2024-08-04T12:11:19.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level
w a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2020090064 - https://www.exploit-db.com/exploits/48809
CVE ID: CVE-2020-13260 State: PUBLISHED Published: 2020-09-17T19:49:01 Last Updated: 2024-08-04T12:11:19.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259. Additional Analyst Notes: - C
er opens an affected web page. This could be exploited in conjunction with CVE-2020-13259. Additional Analyst Notes: - CVE Program Container: References: - https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837 - https://www.exploit-db.com/exploits/48807 - https://cxsecurity.com/issue/WLB-2020090063
CVE ID: CVE-2020-13261 State: PUBLISHED Published: 2020-06-19T22:11:59 Last Updated: 2024-08-04T12:11:19.551Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/199242 - https://hackerone.com/reports/784130 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13261.json
CVE ID: CVE-2020-13262 State: PUBLISHED Published: 2020-06-19T21:59:20 Last Updated: 2024-08-04T12:11:19.462Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/211949 - https://hackerone.com/reports/824689 -
m Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/211949 - https://hackerone.com/reports/824689 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13262.json
CVE ID: CVE-2020-13263 State: PUBLISHED Published: 2020-06-19T22:15:37 Last Updated: 2024-08-04T12:11:19.416Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/211940 - https://hackerone.com/reports/819821 - https://gitlab.com/gitlab-org/cves/-/blob/mast
itlab-org/gitlab/-/issues/211940 - https://hackerone.com/reports/819821 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.json
CVE ID: CVE-2020-13264 State: PUBLISHED Published: 2020-06-19T22:13:52 Last Updated: 2024-08-04T12:11:19.466Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/55302 - https://hackerone.com/reports/702796 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13264.json
CVE ID: CVE-2020-13265 State: PUBLISHED Published: 2020-06-19T21:42:04 Last Updated: 2024-08-04T12:11:19.478Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Insufficient verification of data authenticity in GitLab Description: User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/121664 - https://hackerone.com/reports/762568 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13265.json
CVE ID: CVE-2020-13266 State: PUBLISHED Published: 2020-06-09T15:34:39 Last Updated: 2024-08-04T12:11:19.473Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Missing authorization in GitLab Description: Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/208449 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13266.json
CVE ID: CVE-2020-13267 State: PUBLISHED Published: 2020-06-10T14:29:12 Last Updated: 2024-08-04T12:11:19.470Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/211956 - https://hackerone.com/reports/824773 - https://gitlab.com/gitlab-org/cves/-/blob/
om/gitlab-org/gitlab/-/issues/211956 - https://hackerone.com/reports/824773 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13267.json
CVE ID: CVE-2020-13268 State: PUBLISHED Published: 2020-06-10T14:32:13 Last Updated: 2024-08-04T12:11:19.488Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/214220 - https://hackerone.com/reports/848415 - https://gitlab.com/gitlab-org/cves/-/blob/master/
ab-org/gitlab/-/issues/214220 - https://hackerone.com/reports/848415 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13268.json
CVE ID: CVE-2020-13269 State: PUBLISHED Published: 2020-06-10T14:38:12 Last Updated: 2024-08-04T12:11:19.487Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/216528 - https://hackerone.com/reports/864356 - https://gitlab.com/gitlab-org/c
://gitlab.com/gitlab-org/gitlab/-/issues/216528 - https://hackerone.com/reports/864356 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13269.json
CVE ID: CVE-2020-13270 State: PUBLISHED Published: 2020-06-10T14:35:07 Last Updated: 2024-08-04T12:11:19.468Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/24648 - https://hackerone.com/reports/419977 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13270.json
CVE ID: CVE-2020-13271 State: PUBLISHED Published: 2020-06-10T14:25:15 Last Updated: 2024-08-04T12:11:19.411Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/200094 - https://hackerone.com/reports/672150 - https://gitlab.com/gitlab-org/cves/-/
lab.com/gitlab-org/gitlab/-/issues/200094 - https://hackerone.com/reports/672150 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13271.json
CVE ID: CVE-2020-13272 State: PUBLISHED Published: 2020-06-19T21:40:04 Last Updated: 2024-08-04T12:11:19.447Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/37038 - https://hackerone.com/reports/743556 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13272.json
CVE ID: CVE-2020-13273 State: PUBLISHED Published: 2020-06-19T21:51:37 Last Updated: 2024-08-04T12:11:19.428Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/207349 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13273.json
CVE ID: CVE-2020-13274 State: PUBLISHED Published: 2020-06-19T21:53:45 Last Updated: 2024-08-04T12:11:19.491Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/14195 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13274.json
CVE ID: CVE-2020-13275 State: PUBLISHED Published: 2020-06-19T21:55:32 Last Updated: 2024-08-04T12:11:19.491Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/209254 - https://hackerone.com/reports/806255 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13275.json
CVE ID: CVE-2020-13276 State: PUBLISHED Published: 2020-06-19T21:37:54 Last Updated: 2024-08-04T12:11:19.431Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/25994 - https://hackerone.com/reports/471907 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13276.json
CVE ID: CVE-2020-13277 State: PUBLISHED Published: 2020-06-19T17:20:01 Last Updated: 2024-08-04T12:11:19.490Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/220972 - https://hackerone.com/reports/894569 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13277.json