CVE-2020-13348

Removed by vendor...

CVE-2020-13350

CVE-2020-13350 is a CSRF in GitLab CE/EE runner administration page affecting multiple versions: >=13.5.0, =13.4.0, <13.4.5;

CVE-2020-13351

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

CVE-2020-13351

CVE-2020-13351 affects GitLab CE/EE versions with insufficient permission checks in the scheduled pipeline API, allowing an attacker who can view a project to read variable names and values for that project’s scheduled pipelines. Affected versions are >=13.0 and =13.4.0 and =13.5.0 and

CVE-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

CVE-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

CVE-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

CVE-2020-13352

Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: =10.2, =13.4, =13.5, 13.5.2...

Design/Logic Flaw

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

Input validation

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: =12.6, 13.3.9...

CVE-2020-13354

GitLab CE/EE vulnerability CVE-2020-13354 affects GitLab 12.6 and later up to

CVE-2020-13358

CVE-2020-13358 - GitLab Kubernetes agent API permission bypass vulnerable in GitLab CE/EE; affected are GitLab versions with ranges: >=13.3, =13.4, =13.5,

CVE-2020-26406

GitLab GitLab EE vulnerability CVE-2020-26406: Certain SAST CiConfiguration information could be viewed by unauthorized users via GraphQL. Affected products/versions: GitLab EE 13.3 (up to 13.3.8), 13.4 (up to 13.4.4), and 13.5 (up to 13.5.1). Root cause: misexposure of SAST CiConfiguration data ...

CVE-2020-26406

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are:...

CVE-2020-26406

Removed by vendor...

rehvid365.ee Cross Site Scripting vulnerability OBB-1393328

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2020-14663 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 7.3.1 Liferay Portal 6.2 EE Liferay DXP versions prior to 7.2 Description: The issue allows the property 'portlet.resource.id.banned.paths.regexp' to be bypassed using doubled encoded URLs. Recommendations: Fo...

Authorization

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...

CVE-2020-13300

GitLab CE/EE 13.3 prior to 13.3.4 is affected by CVE-2020-13300 due to an OAuth authorization scope change without user consent during the authorization flow. This could enable unintended expansion of granted permissions during OAuth. Remediation: upgrade to GitLab 13.3.4 or later. CVSS metrics i...

Fedora: Security Advisory for eclipse-webtools (FEDORA-2020-cf8ef2f333)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...