NVD-CWE-noinfo

GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.

An elevation of privilege vulnerability exists when the Shell infrastructure component improperly handles objects in memory, aka ‘Windows Shell Infrastructure Component Elevation of Privilege Vulnerability’.

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers’ pipeline trigger descriptions within the same project.

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the “Mint Tool” feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.

An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes’ routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.