[Git][security-tracker-team/security-tracker][master] Add references for gitlab which should hopefully help tracking fix

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
74c8c5eb by Salvatore Bonaccorso at 2019-12-20T19:55:41Z
Add references for gitlab which should hopefully help tracking fix

There was no gitlab advisory for those issues yet (possibly scheduled
for 2019-12-22?). In case this is not true the added references should
help further track the fixed versions.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -18971,10 +18971,12 @@ CVE-2019-15592
 	RESERVED
 CVE-2019-15591 (An improper access control vulnerability exists in GitLab <12.3.3 t ...)
 	- gitlab <unfixed>
+	NOTE: https://hackerone.com/reports/676976
 CVE-2019-15590
 	RESERVED
 CVE-2019-15589 (An improper access control vulnerability exists in Gitlab <v12.3.2, ...)
 	- gitlab <unfixed>
+	NOTE: https://hackerone.com/reports/497047
 CVE-2019-15588 (There is an OS Command Injection in Nexus Repository Manager <= 2.1 ...)
 	NOT-FOR-US: Nexus Repository Manager
 CVE-2019-15587 (In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may o ...)
@@ -19001,10 +19003,13 @@ CVE-2019-15578
 	RESERVED
 CVE-2019-15577 (An information disclosure vulnerability exists in GitLab CE/EE <v12 ...)
 	- gitlab <unfixed>
+	NOTE: https://hackerone.com/reports/636560
 CVE-2019-15576 (An information disclosure vulnerability exists in GitLab CE/EE <v12 ...)
 	- gitlab <unfixed>
+	NOTE: https://hackerone.com/reports/633001
 CVE-2019-15575 (A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, a ...)
 	- gitlab <unfixed>
+	NOTE: https://hackerone.com/reports/682442
 CVE-2019-15574 (Gesior-AAC before 2019-05-01 allows serviceID SQL injection in account ...)
 	NOT-FOR-US: Gesior-AAC
 CVE-2019-15573 (Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/74c8c5ebacce2e6193f3a51430e2ed583a08d240

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/74c8c5ebacce2e6193f3a51430e2ed583a08d240
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20191220/98274165/attachment.html>