CVE-2019-14942

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-149439.8An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.CVE-2019-149446.5An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows i CVE-2019-149455.4The ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-149465.4The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-149475.4The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-149485.4The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-149496.1The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-149506.1The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.CVE-2019-149517.5The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-forc CVE-2019-149526.1JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.CVE-2019-149536.1JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.CVE-2019-149545.9JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.