CVE-2020-10975: Undefined Security Weakness

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...

CVE-2020-10978: Undefined Security Weakness

GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API...

CVE-2020-10977: Improper Limitation of a Pathname to a Restricted Directory

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...

CVE-2020-1732

A flaw was found in WildFly where multiple requests occurring concurrently could be handled using the identity of another request. This vulnerability occurs when using EE Security with WildFly Elytron. The largest threat from this vulnerability is data confidentiality and integrity...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

CVE-2020-10953

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

Path traversal

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

CVE-2020-10953

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

CVE-2020-10952

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

CVE-2020-10953

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

CVE-2020-10953

Removed by vendor...

CVE-2020-10952: Undefined Security Weakness

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

CVE-2020-10955: Missing Authorization

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...

CVE-2020-10953: Improper Limitation of a Pathname to a Restricted Directory

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...

GitLab: SSRF on project import via the remote_attachment_url on a Note

Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...

CVE-2020-10073

CVE-2020-10073 affects GitLab EE versions 12.4.2–12.8.1. A DoS could be triggered by a flaw in permissions checks that may impact a project homepage. Exploitation details are not provided in the documents; no in‑the‑wild exploit info is referenced. Remediation is to upgrade to a fixed release (e....

CVE-2020-10084

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

CVE-2020-10084

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

Information disclosure

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...

CVE-2020-10077

CVE-2020-10077 affects GitLab EE 3.0–12.8.1 and is caused by a deprecated service that enabled a server-side request forgery (SSRF) risk. The connected documents consistently describe the vulnerability as originating from that deprecated component, with no publicly provided details on exact vulne...