CVE-2018-19575

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

Design/Logic Flaw

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19575

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19575

Removed by vendor...

CVE-2018-19575

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19575

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19575

CVE-2018-19575 affects GitLab CE/EE: versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1 are vulnerable to an insecure direct object reference that allows a user to comment on a locked issue. Root cause is an insecure direct object reference in issue commenting log...

PT-2019-9867

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.x before 11.3.11 GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue allows authenticated but unauthorized users to view members and milestone details of private groups due to...

PT-2019-9865

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue is related to an insecure direct object reference, allowing unauthorized users to publish draft merge request comments of other users...

PT-2019-9858

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1 through 11.5 Description The issue allows a user to make comments on a locked issue due to an insecure direct object reference. Recommendations For versions 10.1 through 11.3.10, update to version 11.3.11 or later. F...

CVE-2018-19584: Authorization Bypass Through User-Controlled Key

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups...

CVE-2018-19575: Authorization Bypass Through User-Controlled Key

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

Design/Logic Flaw

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...

CVE-2019-13461

PrestaShop

PT-2019-13347

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.6.0 RC2 Description The issue allows an attacker to leak personal customer information due to an Insecure Direct Object Reference vulnerability. This is caused by guessable values sent to the web application...

CVE-2019-13461: Authorization Bypass Through User-Controlled Key

In PrestaShop before 1.7.6.0 RC2, the idaddressdelivery and idaddressinvoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop...