deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16558
Published: 2019-04-17
Description: A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf
CVE: CVE-2018-16559
Published: 2019-04-17
Description: A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf
CVE: CVE-2018-16561
Published: 2019-04-17
Description: A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the core functionality of the CPU, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.
CVSS Score: 7.5 (HIGH)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-306710.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-306710.pdf
CVE: CVE-2019-3708
Published: 2019-04-17
Description: IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2019/Apr/16; https://seclists.org/fulldisclosure/2019/Apr/16
CVE: CVE-2019-3709
Published: 2019-04-17
Description: IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2019/Apr/16; https://seclists.org/fulldisclosure/2019/Apr/16
CVE: CVE-2019-3798
Published: 2019-04-17
Description: Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/108095; https://www.cloudfoundry.org/blog/cve-2019-3798; http://www.securityfocus.com/bid/108095
CVE: CVE-2019-3883
Published: 2019-04-17
Description: In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772, CWE-772
References: https://access.redhat.com/errata/RHSA-2019:1896; https://access.redhat.com/errata/RHSA-2019:3401; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883
CVE: CVE-2019-6568
Published: 2019-04-17
Description: The webserver of the affected devices contains a vulnerability that may lead to
a denial of service condition. An attacker may cause a denial of service
situation which leads to a restart of the webserver of the affected device.

The security vulnerability could be exploited by an attacker with network
access to the affected systems. Successful exploitation requires no system
privileges and no user interaction. An attacker could use the vulnerability
to compromise availability of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-530931.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf
CVE: CVE-2019-6570
Published: 2019-04-17
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-280, CWE-863
References: https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
CVE: CVE-2019-6575
Published: 2019-04-17
Description: A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V2.7), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Upd 4), SIMATIC IPC DiagMonitor (All versions < V5.1.3), SIMATIC NET PC Software V13 (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC RF188C (All versions < V1.1.0), SIMATIC RF600R family (All versions < V3.2.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 < V2.6.1), SIMATIC S7-1500 Software Controller (All versions between V2.5 (including) and V2.7 (excluding)), SIMATIC WinCC OA (All versions < V3.15 P018), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Upd 4), SINEC NMS (All versions < V1.0 SP1), SINEMA Server (All versions < V14 SP2), SINUMERIK OPC UA Server (All versions < V2.1), TeleControl Server Basic (All versions < V3.1.1). Specially crafted network packets sent to affected devices on port 4840/tcp could allow an unauthenticated remote attacker to cause a denial of service condition of the OPC communication or crash the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the OPC communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248, CWE-755
References: https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf
CVE: CVE-2019-6579
Published: 2019-04-17
Description: A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP could execute system commands with administrative privileges. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises confidentiality, integrity or availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.securityfocus.com/bid/107830; https://cert-portal.siemens.com/productcert/pdf/ssa-324467.pdf; http://www.securityfocus.com/bid/107830
CVE: CVE-2019-9494
Published: 2019-04-17
Description: The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208, CWE-524, CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
CVE: CVE-2019-9495
Published: 2019-04-17
Description: The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS Score: 3.7 (LOW)
CWE: CWE-524, CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00030.html
CVE: CVE-2019-9496
Published: 2019-04-17
Description: An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-642, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
CVE: CVE-2019-9497
Published: 2019-04-17
Description: The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-301, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00030.html
CVE: CVE-2019-9498
Published: 2019-04-17
Description: The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00030.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
CVE: CVE-2019-9499
Published: 2019-04-17
Description: The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00030.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
CVE: CVE-2019-6150
Published: 2019-04-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-6151
Published: 2019-04-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-6152
Published: 2019-04-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-6153
Published: 2019-04-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2018-10959
Published: 2019-04-17
Description: Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trigger automatic elevation of an attacker's process launch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-426
References: https://hackandpwn.com/assets/2019-04-17-cve-2018-10959/Defendpoint_Windows_Client_Release_Notes_4.4.267.0_SR6.pdf; https://hackandpwn.com/assets/2019-04-17-cve-2018-10959/Defendpoint_Windows_Client_Release_Notes_5.1.149.0_SR1.pdf; https://hackandpwn.com/cve-2018-10959/
CVE: CVE-2018-13378
Published: 2019-04-17
Description: An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://fortiguard.com/advisory/FG-IR-18-382; https://fortiguard.com/advisory/FG-IR-18-382
CVE: CVE-2018-4004
Published: 2019-04-17
Description: An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality. A non-root user is able to kill any privileged process on the system. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0673; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0673
CVE: CVE-2018-4005
Published: 2019-04-17
Description: An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine for a successful exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0674; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0674
CVE: CVE-2018-4006
Published: 2019-04-17
Description: An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. A non-root user is able to write a file anywhere on the system. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to exploit it successfully.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0675; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0675
CVE: CVE-2018-4007
Published: 2019-04-17
Description: An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. The program is able to delete any protected file on the system. An attacker would need local access to the machine to successfully exploit the bug.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0676; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0676
CVE: CVE-2018-7340
Published: 2019-04-17
Description: Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-347
References: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations; https://www.kb.cert.org/vuls/id/475445; https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
CVE: CVE-2019-0228
Published: 2019-04-17
Description: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E; https://lists.apache.org/thread.html/8a19bd6d43e[PII_REDACTED]43c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E; https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E
CVE: CVE-2019-10947
Published: 2019-04-17
Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/107989; https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01; https://www.zerodayinitiative.com/advisories/ZDI-19-399/
CVE: CVE-2019-10949
Published: 2019-04-17
Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be exploited, allowing information disclosure due to a lack of user input validation for processing specially crafted project files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/107989; https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01; https://www.zerodayinitiative.com/advisories/ZDI-19-406/
CVE: CVE-2019-10951
Published: 2019-04-17
Description: Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/107989; https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01; https://www.zerodayinitiative.com/advisories/ZDI-19-405/
CVE: CVE-2019-10953
Published: 2019-04-17
Description: ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://www.securityfocus.com/bid/108413; https://ics-cert.us-cert.gov/advisories/ICSA-19-106-03; http://www.securityfocus.com/bid/108413
CVE: CVE-2019-8453
Published: 2019-04-17
Description: Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-114, CWE-426
References: http://www.securityfocus.com/bid/108029; https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960; http://www.securityfocus.com/bid/108029
CVE: CVE-2019-8455
Published: 2019-04-17
Description: A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-65, CWE-59
References: http://www.securityfocus.com/bid/108029; https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.260.17960; http://www.securityfocus.com/bid/108029
CVE: CVE-2019-9170
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51971