deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-12489
Published: 2019-11-26
Description: An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, it is possible to inject and execute a command between two & characters in the mount parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/garis/Fastgate; https://www.exploit-db.com/exploits/47654; https://github.com/garis/Fastgate
CVE: CVE-2019-18460
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18461
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18462
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18463
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-19206
Published: 2019-11-26
Description: Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76; https://www.dolibarr.org/forum/dolibarr-changelogs; https://medium.com/%40k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76
CVE: CVE-2019-19274
Published: 2019-11-26
Description: typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.python.org/issue36495; https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55e; https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c
CVE: CVE-2019-19275
Published: 2019-11-26
Description: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.python.org/issue36495; https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55e; https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c
CVE: CVE-2019-19306
Published: 2019-11-26
Description: The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2019-19306-zoho.html; https://github.com/cybersecurityworks/Disclosed/issues/16; https://wordpress.org/plugins/zoho-crm-forms/#developers
CVE: CVE-2019-6675
Published: 2019-11-26
Description: BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an authentication bypass. This can result in a complete compromise of the system. This issue only impacts specific engineering hotfixes using the aforementioned authentication configuration. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.3.0.79.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.97.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.99.6-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.15.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.36.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.40.5-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.11.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.14.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.68.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.70.9-ENG.iso, Hotfix-BIGIP-14.1.2.0.11.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.18.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.32.37-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.46.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.14.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.16.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.34.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.97.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.99.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.105.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.111.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.115.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.122.4-ENG.iso, Hotfix-BIGIP-15.0.1.0.33.11-ENG.iso, Hotfix-BIGIP-15.0.1.0.48.11-ENG.iso
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.f5.com/csp/article/K55655944; https://support.f5.com/csp/article/K55655944?utm_source=f5support&amp%3Butm_medium=RSS; https://support.f5.com/csp/article/K55655944
CVE: CVE-2016-9271
Published: 2019-11-26
Description: Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#tsb_210; https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#tsb_210
CVE: CVE-2017-7399
Published: 2019-11-26
Description: Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_tvf_34r_1cb; https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_tvf_34r_1cb
CVE: CVE-2018-20090
Published: 2019-11-26
Description: An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder.
CVSS Score: 8.3 (HIGH)
CWE: CWE-276
References: https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#TSB-351; https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#TSB-351
CVE: CVE-2019-14842
Published: 2019-11-26
Description: Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-681, CWE-681
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842; https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842
CVE: CVE-2019-15685
Published: 2019-11-26
Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable such product's security features as private browsing and anti-banner. Bypass.
CVSS Score: 4.3 (MEDIUM)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE: CVE-2019-15686
Published: 2019-11-26
Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS, Bypass.
CVSS Score: 4.3 (MEDIUM)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE: CVE-2019-15687
Published: 2019-11-26
Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system (like Windows version and version of the product, host unique ID). Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE: CVE-2019-15688
Published: 2019-11-26
Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE: CVE-2019-16241
Published: 2019-11-26
Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ directory. The System application that implements the lock screen checks for the existence of a specific file and disables PIN authentication if it exists. This file would typically be created via Android Debug Bridge (adb) over USB.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-668
References: https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#C; https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories
CVE: CVE-2019-16242
Published: 2019-11-26
Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with physical access to the device can abuse this vulnerability to execute arbitrary OS commands as the root user via the application's UI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/; https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories
CVE: CVE-2019-16243
Published: 2019-11-26
Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. (This web API is normally used by the system application to trigger firmware updates via OmaService.js.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-306
References: https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories; https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#B; https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories
CVE: CVE-2019-18457
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18458
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4).
CVSS Score: 2.7 (LOW)
CWE: CWE-281
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18459
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of 4).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-19129
Published: 2019-11-26
Description: Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://afterlogic.com; https://auroramail.wordpress.com/2019/11/25/vulnerability-closed-in-webmail-and-aurora-remote-stored-xss-in-attachments-name/; https://afterlogic.com
CVE: CVE-2019-19307
Published: 2019-11-26
Description: An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-190, CWE-787, CWE-835
References: https://github.com/cesanta/mongoose/issues/1055; https://github.com/cesanta/mongoose/issues/1055
CVE: CVE-2019-4387
Published: 2019-11-26
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 162715.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162175; https://www.ibm.com/support/pages/node/1115109; https://exchange.xforce.ibmcloud.com/vulnerabilities/162175
CVE: CVE-2019-6477
Published: 2019-11-26
Description: With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html; https://kb.isc.org/docs/cve-2019-6477
CVE: CVE-2019-7319
Published: 2019-11-26
Description: An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges.
CVSS Score: 8.3 (HIGH)
CWE: CWE-269
References: https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_o2p_hjm_33b; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#hue; https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_o2p_hjm_33b
CVE: CVE-2019-12523
Published: 2019-11-26
Description: An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
CVSS Score: 9.1 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html; http://www.squid-cache.org/Advisories/SQUID-2019_8.txt; https://bugzilla.suse.com/show_bug.cgi?id=1156329
CVE: CVE-2019-12526
Published: 2019-11-26
Description: An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.squid-cache.org/Advisories/SQUID-2019_7.txt; https://bugzilla.suse.com/show_bug.cgi?id=1156326; https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html
CVE: CVE-2019-14449
Published: 2019-11-26
Description: An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_sky_fq1_cjb; https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_sky_fq1_cjb
CVE: CVE-2019-15845
Published: 2019-11-26
Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html; https://hackerone.com/reports/449617; https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
CVE: CVE-2019-18446
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18447
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18448
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.
CVSS Score: 6.5 (MEDIUM)
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18449
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18450
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18451
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18452
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18453
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18454
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/