CVE-2020-13277

Removed by vendor...

CVE-2020-13263: Incorrect Authorization

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...

CVE-2020-13264: Exposure of Sensitive Information to an Unauthorized Actor

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...

CVE-2020-13261: Exposure of Sensitive Information to an Unauthorized Actor

Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...

CVE-2020-13262: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...

CVE-2020-13275: Undefined Security Weakness

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13265: Insufficient Verification of Data Authenticity

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13276: Missing Authorization

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13277: Incorrect Authorization

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...

CVE-2020-13273: Undefined Security Weakness

A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1...

Apache TomEE Authorization Issues Vulnerability

Apache TomEE is the United States Apache Software Apache Software Foundation of a lightweight Java EE application server . An authorization issue vulnerability exists in Apache TomEE. An attacker can exploit the vulnerability by sending a specially crafted request using the 'useJMX=true' paramete...

CVE-2020-13268

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

CVE-2020-13271

A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13268

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

Design/Logic Flaw

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

Cross site scripting

A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13269

CVE-2020-13269 : A Reflected Cross-Site Scripting vulnerability affects GitLab CE/EE in the Static Site Editor, with exploits possible on versions 12.10 through 13.0.1. The issue is caused by a reflected XSS flaw that enables execution of arbitrary JavaScript. Public details consistently describe...

CVE-2020-13269

Removed by vendor...

CVE-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

CVE-2020-13268

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...