rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13226 
WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T11:42:27.000Z
CVE-2020-13227 
An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T13:52:28.000Z
CVE-2020-13228 
An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T13:51:45.000Z
CVE-2020-13229 
An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T13:44:11.000Z
CVE-2020-13230 
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T13:40:45.000Z
CVE-2020-13231 
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T13:54:08.000Z
CVE-2020-13238 
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-10T19:53:01.000Z
CVE-2020-13239 
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T14:57:38.000Z
CVE-2020-13240 
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T14:57:22.000Z
CVE-2020-13241 
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T18:53:38.000Z
CVE-2020-13245 
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T18:06:42.000Z
CVE-2020-13246 
An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T17:04:20.000Z
CVE-2020-13247 
BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T19:33:27.000Z
CVE-2020-13248 
BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T18:36:08.000Z
CVE-2020-13249 
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-20T18:48:12.000Z
CVE-2020-13250 
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T19:16:12.000Z
CVE-2020-13252 
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-21T03:35:00.000Z
CVE-2020-13253 
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T14:09:55.000Z
CVE-2020-13254 
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T13:11:57.000Z
CVE-2020-13258 
Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-21T16:06:52.000Z
CVE-2020-13259 
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-16T18:27:44.000Z
CVE-2020-13260 
A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-17T19:49:01.000Z
CVE-2020-13261 
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks @xanbanx for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T22:11:59.000Z
CVE-2020-13262 
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks @yvvdwf for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T21:59:20.000Z
CVE-2020-13263 
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks @sky003 for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T22:15:37.000Z
CVE-2020-13264 
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks @xanbanx for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T22:13:52.000Z
CVE-2020-13265 
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
Problem types: description: Insufficient verification of data authenticity in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks @zapprising for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T21:42:04.000Z
CVE-2020-13266 
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions
Problem types: description: Missing authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab Security Team
Published: 2020-06-09T15:34:39.000Z
CVE-2020-13267 
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks @xanbanx for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-10T14:29:12.000Z
CVE-2020-13268 
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks @ledz1996 for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-10T14:32:13.000Z
CVE-2020-13269 
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks @bull for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-10T14:38:12.000Z
CVE-2020-13270 
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks @ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-10T14:35:07.000Z
CVE-2020-13271 
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks @rpadovani for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-10T14:25:15.000Z
CVE-2020-13272 
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks @peet86 for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T21:40:04.000Z
CVE-2020-13273 
A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-06-19T21:51:37.000Z
CVE-2020-13274 
A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-06-19T21:53:45.000Z
CVE-2020-13275 
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks @izzsec for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T21:55:32.000Z
CVE-2020-13276 
User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Thanks @rgupt for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T21:37:54.000Z
CVE-2020-13277 
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [@u3mur4](https://hackerone.com/u3mur4) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-06-19T17:20:01.000Z
CVE-2020-13278 
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in RosarioSIS
Affected products: vendor: RosarioSIS
product: RosarioSIS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: github.com/M507
Published: 2020-08-12T14:01:44.000Z
CVE-2020-13279 
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
Problem types: description: Uncontrolled search path element in gitlab-vscode-extension
Affected products: vendor: GitLab
product: gitlab-vscode-extension
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: GitLab security research team
Published: 2020-06-22T15:11:56.000Z
CVE-2020-13280 
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.
Problem types: description: Logging of excessive data in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2020-08-13T12:49:19.000Z
CVE-2020-13281 
For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
Problem types: description: Improper handling of highly compressed data (data amplification) in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Thanks [@u3mur4](https://hackerone.com/u3mur4) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-08-13T13:22:23.000Z
CVE-2020-13282 
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks [@kryword](https://hackerone.com/kryword) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2020-08-13T12:33:52.000Z