deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2096
Published: 2023-04-15
Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/service_requests/manage_inventory.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226104.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.226104; https://vuldb.com/?id.226104
CVE: CVE-2023-2097
Published: 2023-04-15
Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226105 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.226105; https://vuldb.com/?id.226105
CVE: CVE-2023-2098
Published: 2023-04-15
Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /inc/topBarNav.php. The manipulation of the argument search leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226106 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.226106; https://vuldb.com/?id.226106
CVE: CVE-2023-2099
Published: 2023-04-15
Description: A vulnerability classified as problematic has been found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226107.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.226107; https://vuldb.com/?id.226107
CVE: CVE-2022-2525
Published: 2023-04-15
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e; https://huntr.dev/bounties/9ff87820-c14c-4454-9[PII_REDACTED]54ef0; https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e
CVE: CVE-2023-2100
Published: 2023-04-15
Description: A vulnerability classified as problematic was found in SourceCodester Vehicle Service Management System 1.0. This vulnerability affects unknown code of the file /admin/report/index.php. The manipulation of the argument date_end leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226108.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%209.pdf; https://vuldb.com/?ctiid.226108; https://vuldb.com/?id.226108
CVE: CVE-2023-2101
Published: 2023-04-15
Description: A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-36
References: https://github.com/c3p0ooo-Yiqiyin/mogu_blog_v2/blob/main/README.md; https://github.com/moxi624/mogu_blog_v2/issues/97; https://vuldb.com/?ctiid.226109
CVE: CVE-2023-2102
Published: 2023-04-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767; https://huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44; https://github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767
CVE: CVE-2023-2103
Published: 2023-04-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/alextselegidis/easyappointments/commit/46a865300e94c7031cc0e315d95d3e3e56768498; https://huntr.dev/bounties/1df09505-9923-43b9-82ef-15d94bc3f9dc; https://github.com/alextselegidis/easyappointments/commit/46a865300e94c7031cc0e315d95d3e3e56768498
CVE: CVE-2023-2104
Published: 2023-04-15
Description: Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-284
References: https://github.com/alextselegidis/easyappointments/commit/75b[PII_REDACTED]8344193fb2cc56e17ee4b9ac4be; https://huntr.dev/bounties/3099b8d1-c49c-41b8-a929-73ccded6fc7c; https://github.com/alextselegidis/easyappointments/commit/75b[PII_REDACTED]8344193fb2cc56e17ee4b9ac4be
CVE: CVE-2023-2105
Published: 2023-04-15
Description: Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://github.com/alextselegidis/easyappointments/commit/7f37350fab9d729a9350d96369ff0f453cf7b840; https://huntr.dev/bounties/de213e0b-a227-4fc3-bbe7-0b33fbf308e1; https://github.com/alextselegidis/easyappointments/commit/7f37350fab9d729a9350d96369ff0f453cf7b840
CVE: CVE-2023-2106
Published: 2023-04-15
Description: Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e; https://huntr.dev/bounties/c3d5c647-7557-40a9-aee4-24dc14882781; https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e
CVE: CVE-2023-2107
Published: 2023-04-15
Description: A vulnerability, which was classified as critical, was found in IBOS 4.5.5. Affected is an unknown function of the file file/personal/del&op=recycle. The manipulation of the argument fids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226110 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/MuRKuo/cve/blob/main/ibos%20oa%20sql.md; https://vuldb.com/?ctiid.226110; https://vuldb.com/?id.226110
CVE: CVE-2023-29201
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2; https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j
CVE: CVE-2023-29202
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qr; https://jira.xwiki.org/browse/XWIKI-19671
CVE: CVE-2023-29203
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1. 

CVSS Score: 3.7 (LOW)
CWE: CWE-359, CWE-668
References: https://github.com/xwiki/xwiki-platform/pull/1883; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83; https://jira.xwiki.org/browse/XWIKI-20007
CVE: CVE-2023-29204
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv; https://jira.xwiki.org/browse/XWIKI-10309
CVE: CVE-2023-29205
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct. 

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24; https://jira.xwiki.org/browse/XWIKI-18568; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24
CVE: CVE-2023-29206
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script rights.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/fe65bc35d5672dd2505b7ac4ec42aec57d500fbb; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cmvg-w72j-7phx; https://jira.xwiki.org/browse/XWIKI-19514
CVE: CVE-2023-29207
Published: 2023-04-15
Description:  XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the Documents Macro that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.

CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6vgh-9r3c-2cxp; https://jira.xwiki.org/browse/XWIKI-15205
CVE: CVE-2023-29208
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8g-fq6x-jqrr; https://jira.xwiki.org/browse/XWIKI-16285
CVE: CVE-2023-29209
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/[PII_REDACTED]4635c028199275db059a4f471e57bc; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9pc2-x9qf-7j2q; https://jira.xwiki.org/browse/XWIKI-20258
CVE: CVE-2023-29210
Published: 2023-04-15
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x; https://jira.xwiki.org/browse/XWIKI-20259
CVE: CVE-2021-30153
Published: 2023-04-15
Description: An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/; https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html; https://phabricator.wikimedia.org/T270453
CVE: CVE-2021-34337
Published: 2023-04-15
Description: An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-208
References: https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51; https://gitlab.com/mailman/mailman/-/issues/911; https://gitlab.com/mailman/mailman/-/tags
CVE: CVE-2021-39295
Published: 2023-04-15
Description: In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q; https://github.com/openbmc/docs/blob/master/release/release-notes.md; https://github.com/openbmc/openbmc
CVE: CVE-2015-10101
Published: 2023-04-15
Description: A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/google-analytics-top-posts-widget/commit/25bb1dea113716200a6f0f3135801d84a7a65540; https://vuldb.com/?ctiid.226117; https://vuldb.com/?id.226117
CVE: CVE-2020-17354
Published: 2023-04-15
Description: LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.
CVSS Score: 8.6 (HIGH)
CWE: CWE-863, CWE-863
References: http://lilypond.org/doc/v2.18/Documentation/usage/command_002dline-usage; https://gitlab.com/lilypond/lilypond/-/merge_requests/1522; https://lilypond.org/download.html
CVE: CVE-2020-29007
Published: 2023-04-15
Description: The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles (potentially including unauthenticated anonymous users) to execute arbitrary Scheme or shell code by using crafted {{Image data to generate musical scores containing malicious code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/seqred-s-a/cve-2020-29007; https://phabricator.wikimedia.org/T257062; https://seqred.pl/en/cve-2020-29007-remote-code-execution-in-mediawiki-score/
CVE: CVE-2021-43612
Published: 2023-04-15
Description: In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/lldpd/lldpd/commit/73d42680fce[PII_REDACTED]dbb31b9bc3b8320adf7; https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/
CVE: CVE-2018-15472
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17449
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17450
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/