Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19535 State: PUBLISHED Published: 2018-11-26T00:00:00 Last Updated: 2024-08-05T11:37:11.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/428 - https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html - https://github.com/Exiv2/exiv2/pull/430 - https://usn.ubuntu.com/4056-1/ - https://access.redhat.com/errata/RHSA-2019:2101 - https://lists.debian.org/debian-lts
- https://usn.ubuntu.com/4056-1/ - https://access.redhat.com/errata/RHSA-2019:2101 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2018-19537 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin may be used in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JackDoan/TP-Link-ArcherC5-RCE
CVE ID: CVE-2018-19539 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html - https://github.com/mdadams/jasper/issues/182 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-19540 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c. Additional Analyst
ap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html - https://github.com/mdadams/jasper/issues/182 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-19541 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c. Additional Anal
ap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html - https://github.com/mdadams/jasper/issues/182 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-19542 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html - https://github.com/mdadams/jasper/issues/182 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-19543 State: PUBLISHED Published: 2018-11-26T03:00:00 Last Updated: 2024-08-05T11:37:11.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mdadams/jasper/issues/182 - https://www.oracle.com/security-alerts/cpuapr2020.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
CVE ID: CVE-2018-19544 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/toiron/setest/blob/64a0b436289c5b177f1a0b28b67719284e03a618/jeecmsaddnews.html
CVE ID: CVE-2018-19545 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/toiron/setest/blob/c72808234498ade31990785d11ee2734738068c4/jeecmsaddusertest.html
CVE ID: CVE-2018-19546 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/toiron/setest - https://github.com/toiron/setest/blob/master/csrfandxss.html
CVE ID: CVE-2018-19547 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/toiron/setest - https://github.com/toiron/setest/blob/master/csrfandxss.html
CVE ID: CVE-2018-19548 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remote attackers to obtain access via a brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EduSec/EduSec/issues/14
CVE ID: CVE-2018-19549 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE ID: CVE-2018-19550 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14 - http://packetstormsecurity.com/files/153018/Interspire-Email-Marketer-6.20-Remote-Code-Execution.html
CVE ID: CVE-2018-19551 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE ID: CVE-2018-19552 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE ID: CVE-2018-19553 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buiquang266/some-vulnerabilities-in-interspire-email-marketer-caa7bc861d14
CVE ID: CVE-2018-19554 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40buxuqua/dotcms-xss-65cdc4174815
CVE ID: CVE-2018-19555 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Spicy1chicken/test/blob/master/Loophole_details.doc
CVE ID: CVE-2018-19556 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/issues/205 - https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/bee6dba066b3f9aa378dcde63e1e0ffad6ad0f49/Url%20hijacking
CVE ID: CVE-2018-19557 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/assnr/arcms/issues/1
CVE ID: CVE-2018-19558 State: PUBLISHED Published: 2018-11-26T07:00:00 Last Updated: 2024-08-05T11:37:11.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/assnr/arcms/issues/1
CVE ID: CVE-2018-19559 State: PUBLISHED Published: 2018-11-26T07:00:00Z Last Updated: 2024-09-16T17:33:45.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/5
CVE ID: CVE-2018-19560 State: PUBLISHED Published: 2018-11-26T07:00:00Z Last Updated: 2024-09-17T01:45:39.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bagesoft/bagecms/issues/4
CVE ID: CVE-2018-19561 State: PUBLISHED Published: 2018-11-26T07:00:00Z Last Updated: 2024-09-16T20:01:27.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chenfeizhou/sikcms-v1.1/issues/1
CVE ID: CVE-2018-19562 State: PUBLISHED Published: 2018-11-26T07:00:00Z Last Updated: 2024-09-16T16:13:27.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background > Program Upgrade > Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/87/
CVE ID: CVE-2018-19564 State: PUBLISHED Published: 2018-11-26T18:00:00Z Last Updated: 2024-09-16T17:03:57.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45900/
CVE ID: CVE-2018-19565 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-16T16:38:32.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2018/q4/165 - https://seclists.org/oss-sec/2018/q4/171
CVE ID: CVE-2018-19566 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-17T02:00:46.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2018/q4/165 - https://seclists.org/oss-sec/2018/q4/171
CVE ID: CVE-2018-19567 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-16T22:13:58.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2018/q4/165 - https://seclists.org/oss-sec/2018/q4/171
CVE ID: CVE-2018-19568 State: PUBLISHED Published: 2018-11-26T20:00:00Z Last Updated: 2024-09-16T20:37:59.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2018/q4/165 - https://seclists.org/oss-sec/2018/q4/171
CVE ID: CVE-2018-19569 State: PUBLISHED Published: 2019-07-10T15:56:27 Last Updated: 2024-08-05T11:37:11.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/50319 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - http://www.securityfocus.com/bid/109118
CVE ID: CVE-2018-19570 State: PUBLISHED Published: 2019-07-10T15:28:42 Last Updated: 2024-08-05T11:37:11.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/52392 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - http://www.securityfocus.com/bid/109169
CVE ID: CVE-2018-19571 State: PUBLISHED Published: 2019-07-10T16:01:50 Last Updated: 2024-08-05T11:37:11.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/53242 - http://packetstormsecurity.com/files/160516/GitLab-11.4.7-Remote-Code-Execution.html - http://packetstormsecurity.com/files/160699/GitLab-11.4.7-Remote-Code-Execution.html
CVE ID: CVE-2018-19572 State: PUBLISHED Published: 2019-07-10T15:32:11 Last Updated: 2024-08-05T11:37:11.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-pages/issues/98 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE ID: CVE-2018-19573 State: PUBLISHED Published: 2019-07-10T15:01:19 Last Updated: 2024-08-05T11:37:11.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/45906 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - http://www.securityfocus.com/bid/109164
CVE ID: CVE-2018-19574 State: PUBLISHED Published: 2019-07-10T15:59:40 Last Updated: 2024-08-05T11:37:11.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/42057 - http://www.securityfocus.com/bid/109163
CVE ID: CVE-2018-19575 State: PUBLISHED Published: 2019-07-10T15:52:43 Last Updated: 2024-08-05T11:37:11.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/52523 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - http://www.securityfocus.com/bid/109121
CVE ID: CVE-2018-19576 State: PUBLISHED Published: 2019-07-10T15:35:53 Last Updated: 2024-08-05T11:37:11.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/51238
CVE ID: CVE-2018-19577 State: PUBLISHED Published: 2019-07-10T14:59:19 Last Updated: 2024-08-05T11:37:11.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/52444 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ - http://www.securityfocus.com/bid/109179
CVE ID: CVE-2018-19578 State: PUBLISHED Published: 2019-07-10T16:54:19 Last Updated: 2024-08-05T11:37:11.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/54228 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE ID: CVE-2018-19579 State: PUBLISHED Published: 2019-07-10T16:52:38 Last Updated: 2024-08-05T11:37:11.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/53917 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE ID: CVE-2018-19580 State: PUBLISHED Published: 2019-07-10T16:04:39 Last Updated: 2024-08-05T11:37:11.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/39809 - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/