CVE-2016-1899: Reflected XSS and header injection in mimetype query string CVE-2016-1900: Stored Cross Site Scripting & Header Injection in Filename Parameter CVE-2016-1901: Integer Overflow resulting in Buffer Overflow Fixed In Version: cgit 0.12