4841 matches found
CVE-2020-10084
Removed by vendor...
CVE-2020-10077: Server-Side Request Forgery (SSRF)
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk...
CVE-2020-10073: Undefined Security Weakness
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page...
CVE-2020-10084: Undefined Security Weakness
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
CVE-2019-13121
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control...
CVE-2019-12428
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...
U.S. Dept Of Defense: Admin Login Credential Leak for DoD Gitlab EE instance
Summary A DoD employee/contractor exposed the ███ password in a GitHub repository █████████ leading to full ███ access in a DoD DISA-associated private Gitlab EE instance ███. Description The IP address ████ recently hosted the subdomain █████████ as of 2019-09-23. ██████ Now port 80 points to a...
CVE-2020-8795
In GitLab Enterprise Edition EE 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
Removed by vendor...
CVE-2020-6833
GitLab EE 11.3 and later is affected by a GitLab Workhorse bypass that could lead to package and file disclosure via request smuggling. The issue is documented across multiple sources (OSV, NVD, CNVD, etc.) with the same core description. The connected documents do not provide a published fix or ...
CVE-2020-7974
GitLab EE 10.1 through 12.7.2 allows Information Disclosure...
CVE-2020-7972
GitLab EE 12.2 has Insecure Permissions issue 2 of 2...
CVE-2020-7972
GitLab EE 12.2 has Insecure Permissions issue 2 of 2...
CVE-2020-7978
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service...