Denial of service

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 12.3 through 12.6.1. It allows Denial of Service...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 10.8 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20145

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 11.4 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20147

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 9.1 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20148

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

Design/Logic Flaw

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 11.0 through 12.6. It allows Uncontrolled Resource Consumption...

CVE-2019-20146

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 11.0 through 12.6. It allows Uncontrolled Resource Consumption...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 9.1 through 12.6.1. It has Incorrect Access Control...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 11.4 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20145

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 11.4 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20145

CVE-2019-20145 affects GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1 with an incorrect access control vulnerability. Connected sources describe an impact where an attacker could commit and post review content to a locked merge request (CNVD-2020-03844). Mitigation ...

PT-2020-18298 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab Community Edition CE and Enterprise Edition EE versions 5.1 through 12.6.1 Description: An issue was discovered with Incorrect Access Control. Recommendations: For versions 5.1 through 12.6.1, update to a version that contains a fix fo...

CVE-2020-1766

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...

CVE-2020-1767

Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...

CVE-2020-1767

Agent A is able to save a draft i.e. for customer reply. Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: OTRS Community Edition 6.0.x version...

CVE-2020-1765

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and...

Input validation

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...

CVE-2020-1765

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and...

CVE-2020-1766

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...