CVE-2018-19570: Improper Neutralization of Input During Web Page Generation

GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags...

CVE-2018-19575: Authorization Bypass Through User-Controlled Key

GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...

CVE-2018-19574: Improper Neutralization of Input During Web Page Generation

GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page...

CVE-2018-19579: Improper Neutralization of Input During Web Page Generation

GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1...

CVE-2018-19578: Improper Authorization

GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page...

PT-2019-9859

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.6 up to 11.3.10 GitLab CE/EE versions 11.4 up to 11.4.7 GitLab CE/EE versions 11.5 up to 11.5.0 Description The issue allows a Guest user to make changes to or delete their own comments on an issue after the issue was...

CVE-2018-19576: Improper Access Control

GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...

CVE-2018-19572: Concurrent Execution using Shared Resource with Improper Synchronization

GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11...

CVE-2018-19571: Server-Side Request Forgery (SSRF)

GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks...

Qualys Cloud Platform (VM, PC) 8.20 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...

rehvid123.ee Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-869385 Security Researcher metamorfosec Helped patch 1957 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting rehvid123.ee website a...

CVE-2018-19585

CVE-2018-19585 covers CRLF Injection in GitLab CE/EE Project Mirroring when using the Git protocol. Affected: GitLab versions 8.18–11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The root cause is CRLF injection in mirroring requests; public material references exploitation o...

PT-2019-9868

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.18 up to 11.x before 11.3.11 GitLab CE/EE versions 11.4.x before 11.4.8 GitLab CE/EE versions 11.5.x before 11.5.1 Description The issue is related to CRLF Injection in Project Mirroring when using the Git protocol...

CVE-2018-19585: Improper Neutralization of CRLF Sequences

GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol...

Authorization Bypass

wildfly-ee is vulnerable to authorization bypass. The vulnerability exists as an incorrect SecurityIdentity for wildfly-ee concurrency could be used when a ElytronManagedThread that uses a different SecurityIdentity does not terminate from its previous thread and executes a new job...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

CVE-2018-18643 affects GitLab CE & EE versions 11.2 and later, up to but not including 11.5.0-rc12, and includes 11.4.6 and 11.3.10. The vulnerability is a Persistent XSS issue described in the CVE entry. The provided connected documents confirm the existence of a persistent cross‑site scripting ...