Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12966 State: PUBLISHED Published: 2019-06-26T11:31:17 Last Updated: 2024-08-04T23:41:08.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm(1)})()} input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zxlie/FeHelper/issues/63
CVE ID: CVE-2019-12967 State: PUBLISHED Published: 2019-10-22T14:58:19 Last Updated: 2024-08-04T23:41:08.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mooltipass/moolticute/commits/master - https://securiteam.io/2019/10/20/cve-2019-12967-moolticute-improper-access-control/
CVE ID: CVE-2019-12968 State: PUBLISHED Published: 2019-06-26T12:02:55 Last Updated: 2024-08-04T23:41:08.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP_Versions 9 to 11 inclusive) distributed with Doomseeker 1.1 and 1.2. Affected plugin versions did not discard IP packets with an unnaturally long response length from a Sonic Robo Blast 2 master server, allowing a remote attacker to cause a potential crash / denial of service in Doomseeker. The issue has been remediated in the Doomseeker 1.3 release with source code patches to the SRB2 plugin. Additional Analyst Notes: - CVE Program Container: References: -
.3 release with source code patches to the SRB2 plugin. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/Doomseeker/doomseeker/commits/b9a90f1f56e704c5cbeefe83da2f9ce939920278 - https://bitbucket.org/Doomseeker/doomseeker/commits/ae456aac888cb794ea3292f7f99cb87d6b22a555 - https://bitbucket.org/Doomseeker/doomseeker/pull-requests/74/more-openbsd-issues-3654-the-srb2-thingy/diff - https://zandronum.com/tracker/view.php?id=3660
CVE ID: CVE-2019-12970 State: PUBLISHED Published: 2019-07-01T10:32:05 Last Updated: 2024-08-04T23:41:09.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-016.txt - https://seclists.
er: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-016.txt - https://seclists.org/bugtraq/2019/Jul/0 - http://packetstormsecurity.com/files/153495/SquirrelMail-1.4.22-Cross-Site-Scripting.html - https://seclists.org/bugtraq/2019/Jul/50 - https://lists.debian.org/debian-lts-announce/2019/08/msg00000.html
CVE ID: CVE-2019-12971 State: PUBLISHED Published: 2019-07-05T19:39:51 Last Updated: 2024-08-04T23:41:08.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jul/6 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-017.txt
CVE ID: CVE-2019-12972 State: PUBLISHED Published: 2019-06-26T13:27:41 Last Updated: 2024-08-04T23:41:09.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=24689 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=890f750a3b053532a4b839a2dd6243076de12031 -
.cgi?id=24689 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=890f750a3b053532a4b839a2dd6243076de12031 - http://www.securityfocus.com/bid/108903 - https://usn.ubuntu.com/4336-1/ - https://security.gentoo.org/glsa/202007-39 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html
CVE ID: CVE-2019-12973 State: PUBLISHED Published: 2019-06-26T17:07:51 Last Updated: 2024-08-04T23:41:09.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108900 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html - https://lists.debian.org/
9/msg00090.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00008.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/uclouvain/openjpeg/pull/1185/commits/cbe7384016083eac16078b359acd7a842253d503 - https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3 - https://security.gentoo.org/glsa/202101-29 - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-12974 State: PUBLISHED Published: 2019-06-26T17:07:59 Last Updated: 2024-08-04T23:41:10.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1515 - http://www.securityfocus.com/bid/108913 - https://lists.debian.org/debian-lts-announce/2019/08/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - h
bian-lts-announce/2019/08/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-12975 State: PUBLISHED Published: 2019-06-26T17:08:07 Last Updated: 2024-08-04T23:41:09.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1517 - http://www.securityfocus.com/bid/108913 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-12976 State: PUBLISHED Published: 2019-06-26T17:08:56 Last Updated: 2024-08-04T23:41:09.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1520 - http://www.securityfocus.com/bid/108913 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-12977 State: PUBLISHED Published: 2019-06-26T17:09:05 Last Updated: 2024-08-04T23:41:10.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1518 - http://www.securityfocus.com/bid/108913 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-12978 State: PUBLISHED Published: 2019-06-26T17:09:13 Last Updated: 2024-08-04T23:41:09.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1519 - http://www.securityfocus.com/bid/108913 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-12979 State: PUBLISHED Published: 2019-06-26T17:09:24 Last Updated: 2024-08-04T23:41:09.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1522 - http://www.securityfocus.com/bid/108913 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian
.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-12980 State: PUBLISHED Published: 2019-06-26T17:09:31 Last Updated: 2024-08-04T23:41:09.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/commit/a009a38dce1d9316cad1ab522b813b1d5ba4c62a
CVE ID: CVE-2019-12981 State: PUBLISHED Published: 2019-06-26T17:09:38 Last Updated: 2024-08-04T23:41:09.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/commit/6e76e8c71cb51c8ba0aa9737a636b9ac3029887f
CVE ID: CVE-2019-12982 State: PUBLISHED Published: 2019-06-26T17:09:46 Last Updated: 2024-08-04T23:41:10.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/commit/da9d86eab55cbf608d5c916b8b690f5b76bca462
CVE ID: CVE-2019-12983 State: REJECTED Published: 2019-06-26T17:09:56 Last Updated: 2019-06-27T00:17:03 Description: No description available.
CVE ID: CVE-2019-12984 State: PUBLISHED Published: 2019-06-26T17:10:03 Last Updated: 2024-08-04T23:41:10.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/385097a3675749cbc9e97c085c0e5dfe4269ca51 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13 - http://www.securityfocus.com/bid/108905 - https://security.net
//cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13 - http://www.securityfocus.com/bid/108905 - https://security.netapp.com/advisory/ntap-20190806-0001/ - https://www.debian.org/security/2019/dsa-4495 - https://seclists.org/bugtraq/2019/Aug/13 - https://usn.ubuntu.com/4093-1/ - https://usn.ubuntu.com/4094-1/ - http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html - https://usn.ubuntu.com/4117-1/ - https://usn.ubuntu.com/4118-1/
CVE ID: CVE-2019-12985 State: PUBLISHED Published: 2019-07-16T17:53:12 Last Updated: 2024-08-04T23:41:08.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133 - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12986 State: PUBLISHED Published: 2019-07-16T17:47:04 Last Updated: 2024-08-04T23:41:09.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133 - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12987 State: PUBLISHED Published: 2019-07-16T17:42:46 Last Updated: 2024-08-04T23:41:10.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133 - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12988 State: PUBLISHED Published: 2019-07-16T17:39:56 Last Updated: 2024-08-04T23:41:09.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133 - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12989 State: PUBLISHED Published: 2019-07-16T17:32:44.000Z Last Updated: 2025-10-21T23:45:33.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2019-32 - http://www.securityfocus.com/bid/109133 - http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12990 State: PUBLISHED Published: 2019-07-16T17:29:01 Last Updated: 2024-08-04T23:41:09.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133
CVE ID: CVE-2019-12991 State: PUBLISHED Published: 2019-07-16T17:16:38.000Z Last Updated: 2025-10-21T23:45:33.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2019-32 - http://www.securityfocus.com/bid/109133 - http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12992 State: PUBLISHED Published: 2019-07-16T17:12:31 Last Updated: 2024-08-04T23:41:10.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-31 - http://www.securityfocus.com/bid/109133 - https://support.citrix.com/article/CTX251987
CVE ID: CVE-2019-12994 State: PUBLISHED Published: 2019-08-08T17:31:45 Last Updated: 2024-08-04T23:41:10.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory/CVE-2019-12994
CVE ID: CVE-2019-12995 State: PUBLISHED Published: 2019-06-28T09:55:48 Last Updated: 2024-08-04T23:41:10.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmentation fault. Additional Analyst Notes: - CVE Program Container: References: - https://istio.io/about/notes/ - https://github.com/istio/istio/issues/15084 - https://github.com/istio/istio.io/pull/4555
CVE ID: CVE-2019-12996 State: PUBLISHED Published: 2019-09-10T18:43:06 Last Updated: 2024-08-04T23:41:10.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe. Additional Analyst Notes: - CVE Program Container: References: - https://docs.mendix.com/releasenotes/studio-pro/7.23#7236
CVE ID: CVE-2019-12997 State: PUBLISHED Published: 2019-06-28T10:28:14 Last Updated: 2024-08-04T23:41:10.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HOST environment variable). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icon-project/loopchain/issues/231
CVE ID: CVE-2019-12998 State: PUBLISHED Published: 2020-01-31T19:36:05 Last Updated: 2024-08-04T23:41:10.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but it should not be used for real funds." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ElementsProject/lightning/commits/master - https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html
CVE ID: CVE-2019-12999 State: PUBLISHED Published: 2020-01-31T19:38:31 Last Updated: 2024-08-04T23:41:10.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lightningnetwork/lnd/commits/master - https://github.com/lightningnetwork/lnd/releases/tag/v0.7.0-beta - https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html
CVE ID: CVE-2019-13000 State: PUBLISHED Published: 2020-01-31T19:40:03 Last Updated: 2024-08-04T23:41:10.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't put too much money in it." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ACINQ/eclair/commits/master - https://github.com/ACINQ/eclair/releases - https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html
CVE ID: CVE-2019-13001 State: PUBLISHED Published: 2020-03-10T14:49:10 Last Updated: 2024-08-04T23:41:09.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13002 State: PUBLISHED Published: 2020-03-10T14:51:46 Last Updated: 2024-08-04T23:41:10.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13003 State: PUBLISHED Published: 2020-03-10T14:53:30 Last Updated: 2024-08-04T23:41:09.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13004 State: PUBLISHED Published: 2020-03-10T14:54:59 Last Updated: 2024-08-04T23:41:10.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13005 State: PUBLISHED Published: 2020-03-10T14:57:24 Last Updated: 2024-08-04T23:41:10.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/