Cross site scripting

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload wi...

CVE-2019-15586

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2019-15583

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API...

CVE-2019-15586

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2019-5466

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-15578

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

CVE-2019-5466

Technical details about CVE-2019-5466 are not publicly provided in the connected documents. Monitor for updates from vendors (GitLab, Red Hat, Ubuntu, Debian, CVE List) for affected versions, impact, and remediation.

CVE-2019-15582

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

CVE-2019-5465

CVE-2019-5465 affects GitLab CE/EE 8.14 and later. The issue is an information disclosure in the move issue feature that could disclose the newly created issue ID. The Connected documents confirm the vulnerability description across multiple sources, but do not provide concrete remediation detail...

CVE-2019-5465

An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID...

CVE-2019-15583

CVE-2019-15583 affects GitLab Community Edition (CE) and Enterprise Edition (EE) through versions earlier than 12.3.2, 12.2.6, and 12.1.12, where moving an issue from a private project to a public project discloses private labels and the private project namespace via the GitLab API. The underlyin...

CVE-2019-5464

CVE-2019-5464 affects GitLab CE/EE 10.2 and later due to a flawed DNS rebinding protection in lib/gitlab/url_blocker.rb, which can result in SSRF when the library is used. The issue can allow an attacker to trigger requests to the local/internal network (e.g., via webhooks), with high impact (net...

CVE-2019-15586

CVE-2019-15586 is a cross-site scripting vulnerability in the GitLab Mermaid plugin for GitLab CE/EE, affecting versions prior to 12.1.10. The root cause is insufficient validation of client-side data, enabling an attacker to execute arbitrary client-side scripts within affected instances. Practi...

CVE-2019-15586

Removed by vendor...

CVE-2019-5462: Insufficient Session Expiration

A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...

CVE-2019-15586: Improper Neutralization of Input During Web Page Generation

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

PT-2020-19856

Name of the Vulnerable Software and Affected Versions Liferay Portal CE versions 7.1.0 through 7.2.1 GA2 Description The First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are vulnerable to a persistent XSS issue. Any user can modify these fields with a particular...

PT-2020-9720

Name of the Vulnerable Software and Affected Versions Gitlab CE/EE versions prior to 12.1.10 Description A cross-site scripting XSS issue exists in the Mermaid plugin. Recommendations For versions prior to 12.1.10, update to version 12.1.10 or later to resolve the issue...

CVE-2019-5465: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID...

CVE-2019-5466: Authorization Bypass Through User-Controlled Key

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...