4832 matches found
CVE-2020-11649
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...
CVE-2020-11505
GitLab CE/EE prior to 12.7.9, 12.8.x prior to 12.8.9, and 12.9.x prior to 12.9.3 contain a vulnerability where a Workhorse bypass enables NuGet package and file disclosure via request smuggling, exposing sensitive information. A fix was released in GitLab 12.9.3 (and later). Affected components: ...
CVE-2020-11649: Missing Authentication for Critical Function
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...
CVE-2020-10980
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...
CVE-2020-10977
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...
Design/Logic Flaw
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
CVE-2020-10980
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...
CVE-2020-10975: Undefined Security Weakness
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...
CVE-2020-10981: Undefined Security Weakness
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
CVE-2020-10976: Exposure of Sensitive Information to an Unauthorized Actor
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...
CVE-2020-10977: Improper Limitation of a Pathname to a Restricted Directory
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...
CVE-2020-10978: Undefined Security Weakness
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API...
CVE-2020-10979: Undefined Security Weakness
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...
CVE-2020-10980: Server-Side Request Forgery (SSRF)
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...
CVE-2020-1732
A flaw was found in WildFly where multiple requests occurring concurrently could be handled using the identity of another request. This vulnerability occurs when using EE Security with WildFly Elytron. The largest threat from this vulnerability is data confidentiality and integrity...
GitLab: Stored XSS in markdown when redacting references
Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...
CVE-2020-10953
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...
Path traversal
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...