[Git][security-tracker-team/security-tracker][master] new gitlab issues

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6811dda1 by Moritz Muehlenhoff at 2018-06-28T20:05:30+02:00
new gitlab issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -881,12 +881,27 @@ CVE-2018-1000402
 	RESERVED
 CVE-2018-1000401
 	RESERVED
-CVE-2018-12607
-	RESERVED
-CVE-2018-12606
-	RESERVED
-CVE-2018-12605
-	RESERVED
+CVE-2018-12607 [gitlab: Persistent XSS in charts]
+	RESERVED
+	- gitlab <unfixed>
+	[stretch] - gitlab <not-affected> (Only affects >= 10.5)
+	NOTE: https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
+CVE-2018-XXXX [gitlab: Activity feed publicly displaying internal project names]
+	- gitlab <unfixed>
+	[stretch] - gitlab <not-affected> (Only affects >= 10.7)
+	NOTE: https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
+CVE-2018-XXXX [gitlab: Content injection via username]
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
+CVE-2018-12606 [gitlab: wiki XSS]
+	RESERVED
+	- gitlab <unfixed>
+	NOTE: https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
+CVE-2018-12605 [gitlab: XSS in url_for(params)]
+	RESERVED
+	- gitlab <unfixed>
+	[stretch] - gitlab <not-affected> (Only affects 10.7)
+	NOTE: https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/
 CVE-2018-12604 (GreenCMS 2.3.0603 allows remote attackers to obtain sensitive ...)
 	NOT-FOR-US: GreenCMS
 CVE-2018-12603 (Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/6811dda15aa75055bd332886631b128ab2f7629c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/6811dda15aa75055bd332886631b128ab2f7629c
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180628/a66fa076/attachment.html>