Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15535 State: PUBLISHED Published: 2019-08-23T17:47:57 Last Updated: 2024-08-05T00:49:13.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tasking Manager before 3.4.0 allows SQL Injection via custom SQL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hotosm/tasking-manager/releases/tag/v3.4.0 - https://github.com/hotosm/tasking-manager/issues/1731
CVE ID: CVE-2019-15536 State: PUBLISHED Published: 2019-08-23T17:51:20 Last Updated: 2024-08-05T00:49:13.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/YourAcclaim/block_acclaim/pull/18
CVE ID: CVE-2019-15537 State: PUBLISHED Published: 2019-08-23T17:49:40 Last Updated: 2024-08-05T00:49:13.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CESNET/proxystatistics-simplesamlphp-module/releases/tag/v3.1.0 - https://github.com/CESNET/proxystatistics-simplesamlphp-module/pull/18
CVE ID: CVE-2019-15538 State: PUBLISHED Published: 2019-08-25T15:25:26 Last Updated: 2024-08-05T00:49:13.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-xfs/201908230
ce via NFS. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-xfs/20190823035528.GH1037422%40magnolia/ - https://lore.kernel.org/linux-xfs/20190823192433.GA8736%40eldamar.local - https://github.com/torvalds/linux/commit/1fb254aa983bf190cfd685d40c64a480a9bafaee - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaee - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4JZ6AEUKFWBHQAROGMQARJ274PQP2QP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RUDQJXRJQVGHCGR4YZWTQ3ECBI7TXH/ - https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://usn.ubuntu.com/4144-1/ - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://usn.ubuntu.com/4147-1/ - https://support.f5.com/csp/article/K32592426?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-15539 State: PUBLISHED Published: 2020-03-19T18:20:08 Last Updated: 2024-08-05T00:49:13.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=26078 - https://github.com/mantisbt/mantisbt/commit/bd094dede74ff6e313e286e949e2387233a96eea
CVE ID: CVE-2019-15540 State: PUBLISHED Published: 2019-08-25T16:43:54 Last Updated: 2024-08-05T00:49:13.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/cdemu/bugs/119/ - https://sourceforge.net/p/cdemu/code/ci/0e9292c9aa34bf545f43f7efe5f0b94faba94962/ - https://gist.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514e - http://lists.opensuse.org/opensuse-security-announce/2019-
.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514e - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00086.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00089.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00017.html
CVE ID: CVE-2019-15541 State: PUBLISHED Published: 2019-08-26T11:49:39 Last Updated: 2024-08-05T00:49:13.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ctz/rustls/compare/cd66549...17ee52c - https://github.com/ctz/rustls/commit/a93ee1abd2ab19ebe4bf9d684d56637ee54a6074 - https://github.com/ctz/rustls/issues/285
CVE ID: CVE-2019-15542 State: PUBLISHED Published: 2019-08-26T17:10:15 Last Updated: 2024-08-05T00:49:13.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0001.html
CVE ID: CVE-2019-15543 State: PUBLISHED Published: 2019-08-26T17:09:28 Last Updated: 2024-08-05T00:49:13.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0002.html
CVE ID: CVE-2019-15544 State: PUBLISHED Published: 2019-08-26T17:08:30 Last Updated: 2024-08-05T00:49:13.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0003.html - https://lists.apache.org/thread.html/r4ef574a5621b0e670a3ce641e9922543e34f22bf4c9ee9584aa67fcf%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/r00097d0b5b6164ea428554007121d5dc1f88ba2af7b9e977a10572cd%40%3Cdev.hbase.apache.org%3E - https://lists.apache.org/thre
l/r00097d0b5b6164ea428554007121d5dc1f88ba2af7b9e977a10572cd%40%3Cdev.hbase.apache.org%3E - https://lists.apache.org/thread.html/rd64381fb8f92d640c1975dc50dcdf1b8512e02a2a7b20292d3565cae%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/r7fed8dd9bee494094e7011cf3c2ab75bd8754ea314c6734688c42932%40%3Ccommon-issues.hadoop.apache.org%3E
CVE ID: CVE-2019-15545 State: PUBLISHED Published: 2019-08-26T17:07:58 Last Updated: 2024-08-05T00:49:13.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0004.html
CVE ID: CVE-2019-15546 State: PUBLISHED Published: 2019-08-26T17:06:56 Last Updated: 2024-08-05T00:49:13.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0005.html
CVE ID: CVE-2019-15547 State: PUBLISHED Published: 2019-08-26T17:05:33 Last Updated: 2024-08-05T00:49:13.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0006.html
CVE ID: CVE-2019-15548 State: PUBLISHED Published: 2019-08-26T17:02:16 Last Updated: 2024-08-05T00:49:13.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0006.html
CVE ID: CVE-2019-15549 State: PUBLISHED Published: 2019-08-26T16:55:10 Last Updated: 2024-08-05T00:49:13.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0007.html
CVE ID: CVE-2019-15550 State: PUBLISHED Published: 2019-08-26T14:31:38 Last Updated: 2024-08-05T00:49:13.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0008.html
CVE ID: CVE-2019-15551 State: PUBLISHED Published: 2019-08-26T14:39:09 Last Updated: 2024-08-05T00:49:13.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0009.html - https://github.com/servo/rust-smallvec/issues/148
CVE ID: CVE-2019-15552 State: PUBLISHED Published: 2019-08-26T14:41:50 Last Updated: 2024-08-05T00:49:13.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0010.html - https://github.com/sile/libflate/issues/35
CVE ID: CVE-2019-15553 State: PUBLISHED Published: 2019-08-26T14:33:08 Last Updated: 2024-08-05T00:49:13.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0011.html - https://github.com/Gilnaa/memoffset/issues/9#issuecomment-505461490
CVE ID: CVE-2019-15554 State: PUBLISHED Published: 2019-08-26T14:35:22 Last Updated: 2024-08-05T00:49:13.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0012.html - https://github.com/servo/rust-smallvec/issues/149
CVE ID: CVE-2019-15555 State: PUBLISHED Published: 2019-08-26T16:49:40 Last Updated: 2024-08-05T00:49:13.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FredReinink/Wellness-app/pull/18
CVE ID: CVE-2019-15556 State: PUBLISHED Published: 2019-08-26T12:23:27 Last Updated: 2024-08-05T00:49:13.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Pvanloon1983/social_network/pull/4
CVE ID: CVE-2019-15557 State: PUBLISHED Published: 2019-08-26T16:48:16 Last Updated: 2024-08-05T00:49:13.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xm-online/xm-uaa/pull/61
CVE ID: CVE-2019-15558 State: PUBLISHED Published: 2019-08-26T16:47:09 Last Updated: 2024-08-05T00:49:13.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xm-online/xm-commons/pull/62
CVE ID: CVE-2019-15559 State: PUBLISHED Published: 2019-08-26T15:55:33 Last Updated: 2024-08-05T00:49:13.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: DianoxDragon Hawn before 2019-07-10 allows SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DianoxDragon/Hawn/pull/6
CVE ID: CVE-2019-15560 State: PUBLISHED Published: 2019-08-26T15:52:15 Last Updated: 2024-08-05T00:49:13.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opensource-table/reviews-module/pull/6
CVE ID: CVE-2019-15561 State: PUBLISHED Published: 2019-08-26T12:30:18 Last Updated: 2024-08-05T00:49:13.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vpoliakov/FlashLingo/pull/3
CVE ID: CVE-2019-15562 State: PUBLISHED Published: 2019-08-26T12:26:07 Last Updated: 2024-08-05T00:49:13.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jinzhu/gorm/releases/tag/v1.9.10 - https://github.com/go-gorm/gorm/pull/2519 - https://github.com/go-gorm/gorm/pull/2674 - https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427
CVE ID: CVE-2019-15563 State: PUBLISHED Published: 2019-08-26T14:46:57 Last Updated: 2024-08-05T00:49:13.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OHDSI/WebAPI/pull/1101 - https://github.com/OHDSI/WebAPI/releases/tag/v2.7.2 - https://github.com/OHDSI/WebAPI/milestone/28?closed=1
CVE ID: CVE-2019-15564 State: PUBLISHED Published: 2019-08-26T14:43:39 Last Updated: 2024-08-05T00:49:13.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CompassionCH/compassion-switzerland/pull/897
CVE ID: CVE-2019-15565 State: PUBLISHED Published: 2019-08-26T14:42:51 Last Updated: 2024-08-05T00:49:13.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/danidomen/icommktconnector/pull/1
CVE ID: CVE-2019-15566 State: PUBLISHED Published: 2019-08-26T14:36:14 Last Updated: 2024-08-05T00:49:13.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Alfresco/alfresco-android-app/releases/tag/1.8.7 - https://github.com/Alfresco/alfresco-android-app/pull/547
CVE ID: CVE-2019-15567 State: PUBLISHED Published: 2019-08-26T14:34:25 Last Updated: 2024-08-05T00:49:13.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openforis/arena/pull/170
CVE ID: CVE-2019-15568 State: PUBLISHED Published: 2019-08-26T14:32:31 Last Updated: 2024-08-05T00:49:13.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chanzuckerberg/idseq-web/pull/2372
CVE ID: CVE-2019-15569 State: PUBLISHED Published: 2019-08-26T14:30:06 Last Updated: 2024-08-05T00:49:13.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hmcts/ccd-data-store-api/pull/394
CVE ID: CVE-2019-15570 State: PUBLISHED Published: 2019-08-26T14:29:04 Last Updated: 2024-08-05T00:49:13.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bedita/bedita/pull/1608
CVE ID: CVE-2019-15571 State: PUBLISHED Published: 2019-08-26T14:28:17 Last Updated: 2024-08-05T00:49:13.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/clonos/control-pane/pull/20
CVE ID: CVE-2019-15572 State: PUBLISHED Published: 2019-08-26T14:24:50 Last Updated: 2024-08-05T00:49:13.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcomoa/gesior-aac/pull/8
CVE ID: CVE-2019-15573 State: PUBLISHED Published: 2019-08-26T14:24:15 Last Updated: 2024-08-05T00:49:13.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcomoa/gesior-aac/pull/9
CVE ID: CVE-2019-15574 State: PUBLISHED Published: 2019-08-26T14:23:16 Last Updated: 2024-08-05T00:49:13.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcomoa/gesior-aac/pull/11
CVE ID: CVE-2019-15575 State: PUBLISHED Published: 2019-12-18T21:00:16 Last Updated: 2024-08-05T00:49:13.586Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-77 Description: A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/682442
CVE ID: CVE-2019-15576 State: PUBLISHED Published: 2019-12-18T21:00:08 Last Updated: 2024-08-05T00:49:13.643Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/633001
CVE ID: CVE-2019-15577 State: PUBLISHED Published: 2019-12-18T21:00:00 Last Updated: 2024-08-05T00:49:13.757Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/636560
CVE ID: CVE-2019-15578 State: PUBLISHED Published: 2020-01-28T02:46:55 Last Updated: 2024-08-05T00:49:13.672Z Vendors: GitLab Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/650574
CVE ID: CVE-2019-15579 State: PUBLISHED Published: 2020-01-28T02:45:42 Last Updated: 2024-08-05T00:49:13.633Z Vendors: GitLab Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/635516
CVE ID: CVE-2019-15580 State: PUBLISHED Published: 2019-12-18T20:59:15 Last Updated: 2024-08-05T00:49:13.790Z Vendors: n/a Products: gitlab.com Problem Types: CWE-201 Description: An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/667408
CVE ID: CVE-2019-15581 State: PUBLISHED Published: 2020-01-28T02:43:00 Last Updated: 2024-08-05T00:49:13.763Z Vendors: GitLab Products: GitLab EE Problem Types: CWE-639 Description: An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/518995