Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-13278 State: PUBLISHED Published: 2020-08-12T14:01:44 Last Updated: 2024-08-04T12:11:19.473Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: RosarioSIS Products: RosarioSIS Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in RosarioSIS Description: Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/francoisjacquet/rosariosis/-/commit/9cb4fec5
al Analyst Notes: - CVE Program Container: References: - https://gitlab.com/francoisjacquet/rosariosis/-/commit/9cb4fec5fe177f1d3716708b46d1958eac477ebe - https://gitlab.com/francoisjacquet/rosariosis/-/issues/282 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13278.json
CVE ID: CVE-2020-13279 State: PUBLISHED Published: 2020-06-22T15:11:56 Last Updated: 2024-08-04T12:11:19.515Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: GitLab Products: gitlab-vscode-extension Problem Types: Uncontrolled search path element in gitlab-vscode-extension Description: Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/170 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13279.json
CVE ID: CVE-2020-13280 State: PUBLISHED Published: 2020-08-13T12:49:19 Last Updated: 2024-08-04T12:11:19.553Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Logging of excessive data in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/28291 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13280.json
CVE ID: CVE-2020-13281 State: PUBLISHED Published: 2020-08-13T13:22:23 Last Updated: 2024-08-04T12:11:19.554Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper handling of highly compressed data (data amplification) in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/31564 - https://hackerone.com/reports/687730 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13281.json
CVE ID: CVE-2020-13282 State: PUBLISHED Published: 2020-08-13T12:33:52 Last Updated: 2024-08-04T12:11:19.525Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/202687 - https://hackerone.com/reports/790786 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13282.json
CVE ID: CVE-2020-13283 State: PUBLISHED Published: 2020-08-13T12:38:29 Last Updated: 2024-08-04T12:11:19.430Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/218448 - https://hackerone.com/reports/877065 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13283.json
CVE ID: CVE-2020-13284 State: PUBLISHED Published: 2020-09-14T18:48:36 Last Updated: 2024-08-04T12:11:19.437Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Incorrect authorization in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/221040 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13284.json
CVE ID: CVE-2020-13285 State: PUBLISHED Published: 2020-08-13T12:45:07 Last Updated: 2024-08-04T12:11:19.514Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/212626 - https://hackerone.com/reports/831962 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13285.json
CVE ID: CVE-2020-13286 State: PUBLISHED Published: 2020-08-13T13:30:55 Last Updated: 2024-08-04T12:11:19.556Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/215212 - https://hackerone.com/reports/855276 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13286.json
CVE ID: CVE-2020-13287 State: PUBLISHED Published: 2020-09-14T18:43:44 Last Updated: 2024-08-04T12:11:19.555Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/227820 - https://hackerone.com/reports/919468 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13287.json
CVE ID: CVE-2020-13288 State: PUBLISHED Published: 2020-08-12T14:06:41 Last Updated: 2024-08-04T12:11:19.550Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/215538 - https://hackerone.com/reports/856554 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13288.json
CVE ID: CVE-2020-13289 State: PUBLISHED Published: 2020-09-14T18:45:54 Last Updated: 2024-08-04T12:11:19.459Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/20302 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13289.json
CVE ID: CVE-2020-13290 State: PUBLISHED Published: 2020-08-12T14:24:24 Last Updated: 2024-08-04T12:11:19.547Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/32291 - https://hackerone.com/reports/691477 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13290.json
CVE ID: CVE-2020-13291 State: PUBLISHED Published: 2020-08-12T14:15:00 Last Updated: 2024-08-04T12:11:19.532Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/230521 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13291.json
CVE ID: CVE-2020-13292 State: PUBLISHED Published: 2020-08-10T13:33:23 Last Updated: 2024-08-04T12:11:19.453Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/228629 - https://hackerone.com/reports/922456 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13292.json
CVE ID: CVE-2020-13293 State: PUBLISHED Published: 2020-08-10T13:28:58 Last Updated: 2024-08-04T12:11:19.491Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: Access of resource using incompatible type ('type confusion') in GitLab Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/202690 - https://hackerone.com/reports/790634 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13293.json
CVE ID: CVE-2020-13294 State: PUBLISHED Published: 2020-08-10T13:30:12 Last Updated: 2024-08-04T12:11:19.494Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13294.json - https://gitlab.com/gitlab-org/gitlab/-/issues/26147 - https://hackerone.com/reports/469728
CVE ID: CVE-2020-13295 State: PUBLISHED Published: 2020-08-10T13:32:12 Last Updated: 2024-08-04T12:11:19.550Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Runner Problem Types: Server-side request forgery (ssrf) in GitLab Runner Description: For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/209096 - https://hackerone.com/reports/809248 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13295.json
CVE ID: CVE-2020-13296 State: PUBLISHED Published: 2020-09-29T15:54:15 Last Updated: 2024-08-04T12:11:19.552Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Missing authorization in GitLab Description: An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/235996 - https://hackerone.com/reports/957459 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13296.json
CVE ID: CVE-2020-13297 State: PUBLISHED Published: 2020-09-14T21:22:03 Last Updated: 2024-08-04T12:11:19.550Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/32215 - https://hackerone.com/reports/691592 - https://gitlab.com/gitlab-org/cve
//gitlab.com/gitlab-org/gitlab/-/issues/32215 - https://hackerone.com/reports/691592 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13297.json
CVE ID: CVE-2020-13298 State: PUBLISHED Published: 2020-09-14T21:44:42 Last Updated: 2024-08-04T12:11:19.559Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/228841 - https://hackerone.com/reports/923027 - https://gitlab.com/gitlab-org/cves/-/blob/maste
tlab-org/gitlab/-/issues/228841 - https://hackerone.com/reports/923027 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13298.json
CVE ID: CVE-2020-13299 State: PUBLISHED Published: 2020-09-14T18:36:52 Last Updated: 2024-08-04T12:11:19.604Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Insufficient session expiration in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/222508 - https://hackerone.com/reports/896225 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020
/-/issues/222508 - https://hackerone.com/reports/896225 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13299.json
CVE ID: CVE-2020-13300 State: PUBLISHED Published: 2020-09-14T18:34:29 Last Updated: 2024-08-04T12:11:19.601Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/219931 - https://hackerone.com/reports/884766 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13300.json
CVE ID: CVE-2020-13301 State: PUBLISHED Published: 2020-09-14T21:26:35 Last Updated: 2024-08-04T12:11:19.527Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/219378 - https://hackerone.com/reports/882988 - https://gitlab.com/gitlab-org/cves/-/blob
com/gitlab-org/gitlab/-/issues/219378 - https://hackerone.com/reports/882988 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13301.json
CVE ID: CVE-2020-13302 State: PUBLISHED Published: 2020-09-14T21:23:24 Last Updated: 2024-08-04T12:18:16.653Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/25195 - https://hackerone.com/reports/437194 - https://gitlab.com/gitlab-org/cves
/gitlab.com/gitlab-org/gitlab/-/issues/25195 - https://hackerone.com/reports/437194 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13302.json
CVE ID: CVE-2020-13303 State: PUBLISHED Published: 2020-09-15T12:27:32 Last Updated: 2024-08-04T12:18:17.068Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/238887 - https://hackerone.com/reports/962231 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-
tlab/-/issues/238887 - https://hackerone.com/reports/962231 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13303.json
CVE ID: CVE-2020-13304 State: PUBLISHED Published: 2020-09-14T21:19:55 Last Updated: 2024-08-04T12:18:16.662Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/27686 - https://hackerone.com/reports/511260 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/C
g/gitlab/-/issues/27686 - https://hackerone.com/reports/511260 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13304.json
CVE ID: CVE-2020-13305 State: PUBLISHED Published: 2020-09-14T21:42:54 Last Updated: 2024-08-04T12:18:17.023Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/26801 - https://hackerone.com/reports/492621 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13305.json
CVE ID: CVE-2020-13306 State: PUBLISHED Published: 2020-09-14T21:28:16 Last Updated: 2024-08-04T12:18:17.022Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Allocation of resources without limits or throttling in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/223681 - https://hackerone.com/reports/904134 - https://gitlab.com/gitlab-org/cves/-/blo
.com/gitlab-org/gitlab/-/issues/223681 - https://hackerone.com/reports/904134 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13306.json
CVE ID: CVE-2020-13307 State: PUBLISHED Published: 2020-09-15T12:34:43 Last Updated: 2024-08-04T12:18:16.643Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Session fixation in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/31307 - https://hackerone.com/reports/676772 - https://gitlab.com/gitlab-org/cves/-/blob/master
tlab-org/gitlab/-/issues/31307 - https://hackerone.com/reports/676772 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13307.json
CVE ID: CVE-2020-13308 State: PUBLISHED Published: 2020-09-15T12:30:33 Last Updated: 2024-08-04T12:18:17.035Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/29989 - https://hackerone.com/reports/637675 - https://gitlab.com/gitlab
- https://gitlab.com/gitlab-org/gitlab/-/issues/29989 - https://hackerone.com/reports/637675 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13308.json
CVE ID: CVE-2020-13309 State: PUBLISHED Published: 2020-09-14T21:36:54 Last Updated: 2024-08-04T12:18:17.002Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/215879 - https://hackerone.com/reports/860196 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13309.json
CVE ID: CVE-2020-13310 State: PUBLISHED Published: 2020-09-14T21:33:50 Last Updated: 2024-08-04T12:18:17.028Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper handling of exceptional conditions in GitLab Description: A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-runner/-/issues/25857 - https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26819 - http
//gitlab.com/gitlab-org/gitlab-runner/-/issues/25857 - https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26819 - https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13310.json