4832 matches found
CVE-2020-10953
Removed by vendor...
CVE-2020-10953
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...
CVE-2020-10952: Undefined Security Weakness
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...
CVE-2020-10953: Improper Limitation of a Pathname to a Restricted Directory
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...
CVE-2020-10955: Missing Authorization
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...
GitLab: SSRF on project import via the remote_attachment_url on a Note
Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...
CVE-2020-10073
CVE-2020-10073 affects GitLab EE versions 12.4.2–12.8.1. A DoS could be triggered by a flaw in permissions checks that may impact a project homepage. Exploitation details are not provided in the documents; no in‑the‑wild exploit info is referenced. Remediation is to upgrade to a fixed release (e....
CVE-2020-10084
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
CVE-2020-10084
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
Information disclosure
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
CVE-2020-10077
CVE-2020-10077 affects GitLab EE 3.0–12.8.1 and is caused by a deprecated service that enabled a server-side request forgery (SSRF) risk. The connected documents consistently describe the vulnerability as originating from that deprecated component, with no publicly provided details on exact vulne...
CVE-2020-10084
Removed by vendor...
CVE-2020-10073: Undefined Security Weakness
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page...
CVE-2020-10077: Server-Side Request Forgery (SSRF)
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk...
CVE-2020-10084: Undefined Security Weakness
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
CVE-2019-13121
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control...
CVE-2019-12428
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...
U.S. Dept Of Defense: Admin Login Credential Leak for DoD Gitlab EE instance
Summary A DoD employee/contractor exposed the ███ password in a GitHub repository █████████ leading to full ███ access in a DoD DISA-associated private Gitlab EE instance ███. Description The IP address ████ recently hosted the subdomain █████████ as of 2019-09-23. ██████ Now port 80 points to a...