FreeBSD : Gitlab -- Multiple Vulnerabilities (1aa7a094-1147-11ea-b537-001b217b3468)

Gitlab reports : Path traversal with potential remote code execution Private objects exposed through project import Disclosure of notes via Elasticsearch integration Disclosure of comments via Elasticsearch integration DNS Rebind SSRF in various chat notifications Disclosure of vulnerability stat...

GitLab: Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result

Summary When a public group with public projects is transferred to a private group, the code and the wiki of the public project, although now should be private, it is still reachable through search APIs. I set the severity as "medium" and not "high", because any new action over the project issues...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Path traversal with potential remote code execution Private objects exposed through project import Disclosure of notes via Elasticsearch integration Disclosure of comments via Elasticsearch integration DNS Rebind SSRF in various chat notifications Disclosure of vulnerability statu...

CVE-2019-18456

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

Code injection

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

CVE-2019-18456

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

CVE-2019-18456

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

CVE-2019-18456

Removed by vendor...

CVE-2019-18456

CVE-2019-18456 affects GitLab Community and Enterprise Edition 8.17–12.4, specifically in the Search feature when using the Elasticsearch integration. The issue is described as “Insecure Permissions” (referenced as issue 1 of 4) and is noted across multiple vendor channels (Red Hat, SUSE, Debian,...

CVE-2019-18460

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

CVE-2019-18460

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

Improper access control

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

CVE-2019-18460

Removed by vendor...

CVE-2019-18460

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

CVE-2019-18460

CVE-2019-18460 affects GitLab Community and Enterprise Edition 8.15–12.4, in the Comments Search feature provided by the Elasticsearch integration. The issue is an Incorrect Access Control vulnerability in the Elasticsearch-backed comments search, potentially exposing or restricting access to com...

CVE-2019-18456: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

PT-2019-15413

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.17 through 12.4 Description An issue was discovered in the Search feature provided by Elasticsearch integration, related to Insecure Permissions. Recommendations For GitLab Community and...

CVE-2019-18460: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

PT-2019-15417

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.15 through 12.4 Description The issue is related to Incorrect Access Control in the Comments Search feature, which is provided by the Elasticsearch integration. Recommendations For GitLab...

Data-Enriched Profiles on 1.2B People Exposed in Gigantic Leak

An open Elasticsearch server has exposed the rich profiles of more than 1.2 billion people to the open internet. First found on October 16 by researchers Bob Diachenko and Vinny Troia, the database contains more than 4 terabytes of data. It consists of scraped information from social media source...