4841 matches found
CVE-2019-5474: Improper Access Control
An authorization issue was discovered in GitLab EE 12.1.2, 12.0.4, and 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions...
CVE-2019-5462: Insufficient Session Expiration
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...
PT-2020-9718
Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...
CVE-2019-5466: Authorization Bypass Through User-Controlled Key
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...
PT-2020-11134
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.2 and later Description A flawed DNS rebinding protection issue was discovered in the url blocker.rb library, which could result in Server-Side Request Forgery SSRF where the library is utilized. Recommendations For...
Improper access control
An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...
CVE-2020-5197
An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...
CVE-2019-20142
CVE-2019-20142 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.3–12.6.1, allowing a Denial of Service . The Red Hat, NVD, OSV, and CVE records corroborate the DoS impact for GitLab CE/EE 12.3–12.6.1. The issued remediation in the public references indicates a patch r...
CVE-2019-20143
Affected product: GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. The issue is described as an Incorrect Access Control vulnerability. The connected Red Hat and OSV notes corroborate the same description; no further root-cause details are provided in the excerpts. The NVD entry li...
CVE-2019-20144
GitLab CVE-2019-20144 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 10.8 through 12.6.1, with a root cause described as Incorrect Access Control. The NVD CVSS entries indicate a Network attack vector, Low complexity, and Privileges Required: Low, yielding a medium sev...
CVE-2019-20146
Removed by vendor...
CVE-2019-20148
An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...
CVE-2020-5197
CVE-2020-5197 affects GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1–12.6.1 and is described as an Incorrect Access Control flaw. Connected sources confirm the affected software range and the nature of the issue; no exploit details are provided in the documents. A security release ...
CVE-2019-19628
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19312
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...
CVE-2019-19312
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...
Remote code execution
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19629
CVE-2019-19629 affects GitLab Enterprise Edition (EE) versions 10.5 through 12.5.3, 12.4.5, and 12.3.8. The issue arises during transfer of a public project to a private group, where private code could be disclosed through the Group Search API provided by the Elasticsearch integration. Multiple s...
CVE-2019-19628
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...