CVE-2019-11549

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-11557.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succCVE-2019-115505.9Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.CVE-2019-115515.5In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a filCVE-2019-115527.0Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injecCVE-2019-115538.8In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organizatCVE-2019-115545.9The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause aCVE-2019-115555.9The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassCVE-2019-115566.1Pagure before 5.6 allows XSS via the templates/blame.html blame view.CVE-2019-115578.8The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resCVE-2019-115596.1A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via CVE-2019-11567.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who succCVE-2019-115609.8A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotel
CVE-2019-11549: Medium severity, CVSS 6.5 | Vulnix