4131 matches found
CVE-2019-19258
CVE-2019-19258 affects GitLab Enterprise Edition (EE) 10.8 and later through 12.5, described as Incorrect Access Control. Connected documents confirm the affected product/version and nature of the flaw but do not provide technical specifics (root cause, affected components, or fix). No explicit e...
CVE-2019-19256
Removed by vendor...
CVE-2019-19311
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
CVE-2019-19254
CVE-2019-19254 affects GitLab Community Edition (CE) and Enterprise Edition (EE) from 9.6 up to 12.5, described as an Incorrect Access Control issue. The connected sources confirm the impacted versions and indicate a security release for GitLab 12.5.x (12.5.1) addressing the vulnerability; no exp...
CVE-2019-19087: Incorrect Permission Assignment for Critical Resource
Gitlab Enterprise Edition EE before 12.5.1 has Insecure Permissions issue 2 of 2...
CVE-2019-19311: Improper Neutralization of Input During Web Page Generation
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
CVE-2019-19088: Improper Limitation of a Pathname to a Restricted Directory
Gitlab Enterprise Edition EE 11.3 through 12.4.2 allows Directory Traversal...
CVE-2019-19262: Incorrect Permission Assignment for Critical Resource
GitLab Enterprise Edition EE 11.9 and later through 12.5 has Insecure Permissions...
CVE-2019-15576
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...
CVE-2019-15575
A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...
CVE-2019-15577
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed project milestones to be disclosed via groups browsing...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-15577
Removed by vendor...
CVE-2019-15577
CVE-2019-15577 affects GitLab CE/EE < v12.3.2, < v12.2.6,
CVE-2019-15576: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in GitLab CE/EE...
CVE-2019-15575: Improper Neutralization of Special Elements used in a Command
A command injection exists in GitLab CE/EE...
CVE-2019-5486: Authentication Bypass Using an Alternate Path or Channel
A authentication bypass vulnerability exists in GitLab CE/EE...