CVE-2019-19313

GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...

CVE-2019-19313

Removed by vendor...

CVE-2019-19313

CVE-2019-19313 affects GitLab Enterprise Edition: vulnerable versions include 12.3 through 12.5, 12.4.3, and 12.3.6. The issue leads to a Denial of Service: it can render issues and commits uncreatable, uneditable, or viewable due to specific characters. Impact is described as DoS with availabili...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19312

GitLab EE 8.14–12.5, 12.4.3, and 12.3.6 suffer from Incorrect Access Control: after a project is made private, forked repositories could still query the API to obtain information about the private project. Impact is information disclosure via the API; no exploit details are provided beyond this. ...

CVE-2019-19314: Cleartext Storage of Sensitive Information

GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext...

PT-2020-10133

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits. Recommendations Fo...

PT-2020-10134

Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.4 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns the storage of several tokens in plaintext. Recommendations For GitLab EE versions 8.4 through 12.5, update to a version that...

PT-2020-10204

Name of the Vulnerable Software and Affected Versions GitLab EE versions 10.5 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue allows private code to be disclosed via the Group Search API provided by the Elasticsearch integration when transferring a public...

PT-2020-10132

Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns incorrect access control. After a project is changed to private, previously forked repositories can still access information...

PT-2020-10203

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue is related to insufficient parameter sanitization for the Maven package registry, which could lead to privilege escalation and remot...

CVE-2019-19628: Improper Limitation of a Pathname to a Restricted Directory

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19629: Undefined Security Weakness

In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration...

CVE-2019-19312: Undefined Security Weakness

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19313: Improper Handling of Exceptional Conditions

GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...

Improper access control

GitLab Community Edition CE and Enterprise Edition EE through 12.5 has Incorrect Access Control issue 2 of 2...

CVE-2019-19310

CVE-2019-19310 affects GitLab Enterprise Edition (EE) versions 9.0 through 12.5, allowing information disclosure. The connected Red Hat, NVD, Debian, and other feeds corroborate that EE 9.0+ through 12.5 is vulnerable to information leakage; no explicit root cause, affected file/component, or exp...

CVE-2019-19309

GitLab CVE-2019-19309 affects GitLab Enterprise Edition (EE) 8.90 and later through 12.5, described as an Incorrect Access Control issue. Connected sources confirm the affected product scope and that remediation was addressed in GitLab’s releases around 12.5 (e.g., security release 12-5-1). The C...

CVE-2019-19262

GitLab Enterprise Edition (EE) versions 11.9 through 12.5 have an insecure-permissions vulnerability (CVE-2019-19262). The issue concerns improper permissions on components that could enable partial disclosure of sensitive data, notably Grafana metrics, as documented in multiple sources. Affected...

CVE-2019-19260

Technical details about CVE-2019-19260 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories for affected products and fixes.