CVE-2020-13273

CVE-2020-13273 is a Denial of Service vulnerability affecting GitLab CE/EE 12.0 through 13.0.1, causing exhaustion of system resources. The connected documents collectively confirm the affected versions and impact but do not provide the root cause details or explicit remediation steps in the supp...

CVE-2020-13273

Removed by vendor...

CVE-2020-13265

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13272

GitLab CVE-2020-13272 affects GitLab CE/EE versions 12.3 through 13.0.1, where the OAuth authorization code flow lacks verification checks. The root cause is missing verification in the OAuth flow, allowing an unverified user to complete the authorization code flow. Public details in connected do...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13272

Removed by vendor...

CVE-2020-13276

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13276

Removed by vendor...

CVE-2020-13277

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...

Authorization

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...

CVE-2020-13277

The CVE-2020-13277 issue is a real authorization flaw in GitLab’s repository mirroring logic that allowed read access to private repositories in CE/EE. Affected versions span GitLab CE/EE 10.6 through 13.0.5. Remediation per connected details: upgrade to GitLab fixes for the applicable lines (e.g...

CVE-2020-13277

Removed by vendor...

CVE-2020-13276: Missing Authorization

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13262: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...

CVE-2020-13265: Insufficient Verification of Data Authenticity

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13277: Incorrect Authorization

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...

CVE-2020-13261: Exposure of Sensitive Information to an Unauthorized Actor

Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...

CVE-2020-13273: Undefined Security Weakness

A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1...

CVE-2020-13264: Exposure of Sensitive Information to an Unauthorized Actor

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...