Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-20456 State: PUBLISHED Published: 2018-12-25T19:00:00Z Last Updated: 2024-09-17T00:21:35.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 prior to 3.1.1, the parseOperand function inside libr/asm/p/asm_x86_nz.c may allow attackers to cause a denial of service (application crash in libr/util/strbuf.c via a stack-based buffer over-read) by crafting an input file, a related issue to CVE-2018-20455. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/9b46d38dd3c4de6048a488b655c7319f845af185 - https://github.com/radare/radare2/issues/12372
CVE ID: CVE-2018-20457 State: PUBLISHED Published: 2018-12-25T19:00:00 Last Updated: 2024-08-05T12:05:16.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 through 3.1.3, the assemble function inside libr/asm/p/asm_arm_cs.c allows attackers to cause a denial-of-service (application crash via an r_num_calc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/12417 - https://github.com/radareorg/radare2/commit/e5c14c167b0dcf0
ferences: - https://github.com/radare/radare2/issues/12417 - https://github.com/radareorg/radare2/commit/e5c14c167b0dcf0a53d76bd50bacbbcc0dfc1ae7
CVE ID: CVE-2018-20458 State: PUBLISHED Published: 2018-12-25T19:00:00 Last Updated: 2024-08-05T12:05:16.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 prior to 3.1.1, r_bin_dyldcache_extract in libr/bin/format/mach0/dyldcache.c may allow attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting an input file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/12374 - https://github.com/radareorg/radare2/commit/30f4c7b52a4e2dc0d0b1bae487d90f5437c69d19
CVE ID: CVE-2018-20459 State: PUBLISHED Published: 2018-12-25T19:00:00 Last Updated: 2024-08-05T12:05:16.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/12418 - https://github.com/radareorg/radare2/commit/e5c14c167b0dcf0a53d76bd5
- https://github.com/radare/radare2/issues/12418 - https://github.com/radareorg/radare2/commit/e5c14c167b0dcf0a53d76bd50bacbbcc0dfc1ae7
CVE ID: CVE-2018-20460 State: PUBLISHED Published: 2018-12-25T19:00:00Z Last Updated: 2024-09-17T02:16:36.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service (application crash caused by stack-based buffer overflow) by crafting an input file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/df167c7db545953bb7f71c72e98e7a3ca0c793bf - https://github.com/radare/radare2/issues/12376
CVE ID: CVE-2018-20461 State: PUBLISHED Published: 2018-12-25T19:00:00Z Last Updated: 2024-09-16T20:22:17.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 prior to 3.1.1, core_anal_bytes in libr/core/cmd_anal.c allows attackers to cause a denial-of-service (application crash caused by out-of-bounds read) by crafting a binary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/a1bc65c3db593530775823d6d7506a457ed95267 - https://github.com/radare/radare2/issues/12375
CVE ID: CVE-2018-20462 State: PUBLISHED Published: 2018-12-25T21:00:00 Last Updated: 2024-08-05T12:05:17.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9196 - https://www.cbiu.cc/2018/12/WordPress%E6%8F%92%E4%BB%B6jsmol2wp%E6%BC%8F%E6%B4%9E/#%E5%8F%8D%E5%B0%84%E6%80%A7XSS
CVE ID: CVE-2018-20463 State: PUBLISHED Published: 2018-12-25T21:00:00 Last Updated: 2024-08-05T12:05:16.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. This can also be used for SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.cbiu.cc/2018/12/WordPress%E6%8F%92%E4%BB%B6jsmol2wp%E6%BC%8F%E6%B4%9E/#%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96-amp-SSRF - https://wpvulndb.com/vulnerabilities/9197
CVE ID: CVE-2018-20464 State: PUBLISHED Published: 2018-12-25T23:00:00 Last Updated: 2024-08-05T12:05:16.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Xmansec/cmsms_vul
CVE ID: CVE-2018-20465 State: PUBLISHED Published: 2018-12-25T23:00:00 Last Updated: 2024-08-05T12:05:17.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1 - https://github.com/craftcms/cms/blob/m
https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1 - https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md
CVE ID: CVE-2018-20467 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:17.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/db0add932fb850d762b02604ca3053b7d7ab6deb - http://www.securityfocus.com/bid/106315 - https://github.com/ImageMagick/ImageMagick/issues/1408 - http://lists.opensuse.org/opensus
ecurityfocus.com/bid/106315 - https://github.com/ImageMagick/ImageMagick/issues/1408 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2018-20468 State: PUBLISHED Published: 2019-06-17T13:35:05 Last Updated: 2024-08-05T12:05:17.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://barriersec.com/2019/06/cve-2018-20468-sahi-pro/
CVE ID: CVE-2018-20469 State: PUBLISHED Published: 2019-06-17T13:31:57 Last Updated: 2024-08-05T12:05:16.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions. Additional Analyst Notes: - CVE Program Container: References: - https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/ - http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html
CVE ID: CVE-2018-20470 State: PUBLISHED Published: 2019-06-17T13:26:53 Last Updated: 2024-08-05T12:05:16.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files. Additional Analyst Notes: - CVE Program Container: References: - https://barriersec.com/2019/06/cve-2018-20470-sahi-pro/ - http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
CVE ID: CVE-2018-20472 State: PUBLISHED Published: 2019-06-17T13:22:16 Last Updated: 2024-08-05T12:05:16.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://barriersec.com/2019/06/cve-2018-20472-sahi-pro/ - http://packetstormsecurity.com/files/153332/Sahi-Pro-8.x-Cross-Site-Scripting.html
CVE ID: CVE-2018-20476 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:16.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://shell01.top/2018/12/14/scms-xss/#more
CVE ID: CVE-2018-20477 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:16.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field. Additional Analyst Notes: - CVE Program Container: References: - https://shell01.top/2018/12/18/scms-sqlinject/
CVE ID: CVE-2018-20478 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:17.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/3614#toc-0
CVE ID: CVE-2018-20479 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:16.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/3614#toc-2
CVE ID: CVE-2018-20480 State: PUBLISHED Published: 2018-12-26T03:00:00 Last Updated: 2024-08-05T12:05:16.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/3614#toc-2
CVE ID: CVE-2018-20481 State: PUBLISHED Published: 2018-12-26T04:00:00 Last Updated: 2024-08-05T12:05:16.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/692 - https://gitlab.freedesktop.org/poppler/poppler/merge_requests/143 - https://usn.ubuntu.com/3865-1/ - https://lists.debian.org/deb
itlab.freedesktop.org/poppler/poppler/merge_requests/143 - https://usn.ubuntu.com/3865-1/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html - http://www.securityfocus.com/bid/106321 - https://access.redhat.com/errata/RHSA-2019:2022 - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
CVE ID: CVE-2018-20482 State: PUBLISHED Published: 2018-12-26T18:00:00 Last Updated: 2024-08-05T12:05:16.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root). Additional Analyst Notes: - CVE Program Container: References: - https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug - http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e237794
a/~cks/space/blog/sysadmin/TarFindingTruncateBug - http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454 - https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html - https://news.ycombinator.com/item?id=18745431 - http://www.securityfocus.com/bid/106354 - https://security.gentoo.org/glsa/201903-05 - http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html - https://twitter.com/thatcks/status/1076166645708668928 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html - https://lists.debian.org/debian-lts-announce/2021/11/msg00025.html
CVE ID: CVE-2018-20483 State: PUBLISHED Published: 2018-12-26T18:00:00 Last Updated: 2024-08-05T12:05:16.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fw
attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-08 - http://www.securityfocus.com/bid/106358 - https://twitter.com/marcan42/status/1077676739877232640 - http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS - https://security.netapp.com/advisory/ntap-20190321-0002/ - https://usn.ubuntu.com/3943-1/ - https://access.redhat.com/errata/RHSA-2019:3701
CVE ID: CVE-2018-20484 State: PUBLISHED Published: 2018-12-26T18:00:00 Last Updated: 2024-08-05T12:05:16.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html - http://packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html
CVE ID: CVE-2018-20485 State: PUBLISHED Published: 2018-12-26T18:00:00 Last Updated: 2024-08-05T12:05:17.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html - http://packetstormsecurity.com/files/152793/Zoho-ManageEngine-ADSelfService-Plus-5.7-Cross-Site-Scripting.html
CVE ID: CVE-2018-20486 State: PUBLISHED Published: 2018-12-26T19:00:00Z Last Updated: 2024-09-16T18:03:38.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ppsoft1990/Metinfo6.1.3/issues/2 - https://forum.metinfo.cn/thread-1300-1-1.html
CVE ID: CVE-2018-20487 State: PUBLISHED Published: 2019-04-11T20:21:05 Last Updated: 2024-08-05T12:05:17.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as an "include" and point the "path" argument to a malicious script or binary. This gets executed as root when the firewall changes are committed. Additional Analyst Notes: - CVE Program Container: References: - https://neonsea.uk/blog/2018/12/26/firewall-includes.html - http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329f
includes.html - http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=e6159ca928d7f0c143be213afc6bf810c0329fe2
CVE ID: CVE-2018-20488 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/53477
CVE ID: CVE-2018-20489 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:17.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-foss/issues/41500
CVE ID: CVE-2018-20490 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54377
CVE ID: CVE-2018-20491 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54008
CVE ID: CVE-2018-20492 State: PUBLISHED Published: 2019-12-26T16:44:43 Last Updated: 2024-08-05T12:05:17.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE ID: CVE-2018-20493 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:17.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54914
CVE ID: CVE-2018-20494 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:17.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54334
CVE ID: CVE-2018-20495 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/51969
CVE ID: CVE-2018-20496 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54427
CVE ID: CVE-2018-20497 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:17.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/51327
CVE ID: CVE-2018-20498 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:17.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/50995
CVE ID: CVE-2018-20499 State: PUBLISHED Published: 2019-12-30T21:24:28 Last Updated: 2024-08-05T12:05:16.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/55439