Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ - https://hackerone.com/reports/224210 - https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b
CVE ID: CVE-2017-0897 State: PUBLISHED Published: 2017-06-22T21:00:00 Last Updated: 2024-08-05T13:25:16.804Z Vendors: EllisLab Products: ExpressionEngine Problem Types: CWE-330 Description: ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99242 - https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8 - https://hackerone.com/reports/215890 - https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5 - https://expressionengine.com/blog
215890 - https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5 - https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released
CVE ID: CVE-2017-0898 State: PUBLISHED Published: 2017-09-15T19:00:00Z Last Updated: 2024-09-17T01:36:46.258Z Vendors: HackerOne Products: Ruby Problem Types: CWE-134 Description: Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://hackerone.com/reports/212241 - https://access.redhat.com/errata/RHSA-2018:0585 - https://access.redhat.com/errata/RHSA-2018:0378 - https://www.
12241 - https://access.redhat.com/errata/RHSA-2018:0585 - https://access.redhat.com/errata/RHSA-2018:0378 - https://www.debian.org/security/2017/dsa-4031 - http://www.securityfocus.com/bid/100862 - http://www.securitytracker.com/id/1039363 - https://access.redhat.com/errata/RHSA-2017:3485 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://access.redhat.com/errata/RHSA-2018:0583 - https://github.com/mruby/mruby/issues/3722 - https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/ - https://security.gentoo.org/glsa/201710-18
CVE ID: CVE-2017-0899 State: PUBLISHED Published: 2017-08-31T20:00:00Z Last Updated: 2024-09-17T02:20:54.846Z Vendors: HackerOne Products: RubyGems Problem Types: CWE-150 Description: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0585 - https://www.debian.org/security/2017/dsa-3966 - https://access.redhat.com/errata/RHSA-2018:0378 - https://hackerone.com/reports/226335 - http://www.securitytracker.com/id/1039249 - https://github.
rata/RHSA-2018:0378 - https://hackerone.com/reports/226335 - http://www.securitytracker.com/id/1039249 - https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1 - https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491 - https://access.redhat.com/errata/RHSA-2017:3485 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://access.redhat.com/errata/RHSA-2018:0583 - https://security.gentoo.org/glsa/201710-01 - http://www.securityfocus.com/bid/100576 - http://blog.rubygems.org/2017/08/27/2.6.13-released.html
CVE ID: CVE-2017-0900 State: PUBLISHED Published: 2017-08-31T20:00:00 Last Updated: 2024-08-05T13:25:16.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0585 - https://www.debian.org/security/2017/dsa-3966 - https://access.redhat.com/errata/RHSA-2018:0378 - https://hackerone.com/reports/243003 - http://www.securitytracker.com/id/1039249 - https://access.redhat.com/errata/RHSA-2017:3485
kerone.com/reports/243003 - http://www.securitytracker.com/id/1039249 - https://access.redhat.com/errata/RHSA-2017:3485 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - http://www.securityfocus.com/bid/100579 - https://access.redhat.com/errata/RHSA-2018:0583 - https://security.gentoo.org/glsa/201710-01 - http://blog.rubygems.org/2017/08/27/2.6.13-released.html - https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251
CVE ID: CVE-2017-0901 State: PUBLISHED Published: 2017-08-31T20:00:00Z Last Updated: 2024-09-16T20:22:06.483Z Vendors: HackerOne Products: RubyGems Problem Types: CWE-22 Description: RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://usn.ubuntu.com/3553-1/ - https://access.redhat.com/errata/RHSA-2018:0585 - https://www.debian.org/security/2017/dsa-3966 - https://access.redhat.com/errata/RHSA-2018:0378 - https://www.exploit-db.com/exploits/42611/ - http://www.securitytracker.com
://access.redhat.com/errata/RHSA-2018:0378 - https://www.exploit-db.com/exploits/42611/ - http://www.securitytracker.com/id/1039249 - https://hackerone.com/reports/243156 - https://access.redhat.com/errata/RHSA-2017:3485 - https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://access.redhat.com/errata/RHSA-2018:0583 - https://security.gentoo.org/glsa/201710-01 - http://www.securityfocus.com/bid/100580 - http://blog.rubygems.org/2017/08/27/2.6.13-released.html
CVE ID: CVE-2017-0902 State: PUBLISHED Published: 2017-08-31T20:00:00Z Last Updated: 2024-09-17T00:42:39.081Z Vendors: HackerOne Products: RubyGems Problem Types: CWE-350 Description: RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://usn.ubuntu.com/3553-1/ - https://access.redhat.com/errata/RHSA-2018:0585 - https://www.debian.org/security/2017/dsa-3966 - https://access.redhat.com/errata/RHSA-2018:0378 - http://www.securitytracker
s://www.debian.org/security/2017/dsa-3966 - https://access.redhat.com/errata/RHSA-2018:0378 - http://www.securitytracker.com/id/1039249 - https://access.redhat.com/errata/RHSA-2017:3485 - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://access.redhat.com/errata/RHSA-2018:0583 - https://security.gentoo.org/glsa/201710-01 - http://www.securityfocus.com/bid/100586 - https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32 - https://hackerone.com/reports/218088 - http://blog.rubygems.org/2017/08/27/2.6.13-released.html
CVE ID: CVE-2017-0903 State: PUBLISHED Published: 2017-10-11T18:00:00Z Last Updated: 2024-09-17T03:54:57.184Z Vendors: HackerOne Products: RubyGems Problem Types: CWE-502 Description: RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://usn.ubuntu.com/3553-1/ - https://access.redhat.com/errata/RHSA-2018:0585 - https://access.redhat.com/errata/RHSA-2018:0378 - https:/
om/3553-1/ - https://access.redhat.com/errata/RHSA-2018:0585 - https://access.redhat.com/errata/RHSA-2018:0378 - https://hackerone.com/reports/274990 - https://www.debian.org/security/2017/dsa-4031 - https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49 - https://access.redhat.com/errata/RHSA-2017:3485 - http://blog.rubygems.org/2017/10/09/2.6.14-released.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://access.redhat.com/errata/RHSA-2018:0583 - http://www.securityfocus.com/bid/101275 - http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
CVE ID: CVE-2017-0904 State: PUBLISHED Published: 2017-11-13T17:00:00Z Last Updated: 2024-09-17T01:56:09.414Z Vendors: jtdowney Products: private_address_check ruby gem Problem Types: CWE-242 Description: The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/287245 - https://edoverflow.com/2017/ruby-resolv-bug/ - https://github.com/jtdowney/private_address_check
ne.com/reports/287245 - https://edoverflow.com/2017/ruby-resolv-bug/ - https://github.com/jtdowney/private_address_check/issues/1 - https://hackerone.com/reports/287835 - https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
CVE ID: CVE-2017-0905 State: PUBLISHED Published: 2017-11-13T17:00:00Z Last Updated: 2024-09-16T23:56:22.112Z Vendors: Recurly Products: recurly ruby gem Problem Types: CWE-918 Description: The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources. Additional Analyst Notes: - CVE Program Container: References: - https://dev.recurly.com/page/ruby-updates - https://hackerone.com/reports/288635 - https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b
-updates - https://hackerone.com/reports/288635 - https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be
CVE ID: CVE-2017-0906 State: PUBLISHED Published: 2017-11-13T17:00:00Z Last Updated: 2024-09-17T00:50:41.168Z Vendors: Recurly Products: recurly python module Problem Types: CWE-918 Description: The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/288635 - https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742 - https://dev.recurly.com/page/python-updates
CVE ID: CVE-2017-0907 State: PUBLISHED Published: 2017-11-13T17:00:00Z Last Updated: 2024-09-16T23:00:52.282Z Vendors: Recurly Products: recurly-api-client .NET library Problem Types: CWE-918 Description: The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/288635 - https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1 - https://dev.
ts/288635 - https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1 - https://dev.recurly.com/page/net-updates
CVE ID: CVE-2017-0908 State: REJECTED Published: 2017-11-13T09:00:00 Last Updated: 2017-11-13T08:57:01 Description: No description available.
CVE ID: CVE-2017-0909 State: PUBLISHED Published: 2017-11-16T22:00:00Z Last Updated: 2024-09-16T16:49:03.138Z Vendors: HackerOne Products: private_address_check ruby gem Problem Types: CWE-184 Description: The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/288950 - https://github.com/jtdowney/private_address_check/pull/3
CVE ID: CVE-2017-0910 State: PUBLISHED Published: 2017-11-27T16:00:00Z Last Updated: 2024-09-17T01:26:15.105Z Vendors: Zulip Products: Zulip Server Problem Types: CWE-863 Description: In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32 - http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/
CVE ID: CVE-2017-0911 State: PUBLISHED Published: 2018-02-09T22:00:00Z Last Updated: 2024-09-17T03:32:53.282Z Vendors: Twitter Products: Twitter Kit for iOS Problem Types: CWE-360 Description: Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing att
ck handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/290229 - https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html - https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411 - https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017 - https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/Twitter
#322-november-28-2017 - https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71
CVE ID: CVE-2017-0912 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-16T19:15:34.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with "Edit" access to "Scheduling". Additional Analyst Notes: - CVE Program Container: References: - https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814
CVE ID: CVE-2017-0913 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T03:43:59.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization". Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/301406 - https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814
CVE ID: CVE-2017-0914 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.728Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-89 Description: Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/298176 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0915 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.906Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-77 Description: Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://hackerone.com/reports/298873 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0916 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.962Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-77 Description: Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://hackerone.com/reports/299473 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0917 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:17.004Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-79 Description: Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://hackerone.com/reports/299525 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0918 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:17.195Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-23 Description: Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://hackerone.com/reports/301432 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0919 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T02:27:55.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/301137
CVE ID: CVE-2017-0920 State: PUBLISHED Published: 2018-03-22T15:00:00 Last Updated: 2024-08-05T13:25:16.968Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-639 Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/301336 - https://www.debian.org/security/2018/dsa-4206 - https://about.gitlab.com/2018/01/16/gitlab-10-d
one.com/reports/301336 - https://www.debian.org/security/2018/dsa-4206 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0921 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T00:40:46.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/
CVE ID: CVE-2017-0922 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.596Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-639 Description: Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/301123 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0923 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:17.023Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-79 Description: Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/293740 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0924 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:17.209Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-79 Description: Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/ - https://hackerone.com/reports/294099
CVE ID: CVE-2017-0925 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:17.478Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-522 Description: Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://gitlab.com/gitlab-org/gitlab-ee/issues/3847 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0926 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.917Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-285 Description: Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4145 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/32198