PT-2020-13433 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.0.12 GitLab versions prior to 13.1.6 GitLab versions prior to 13.2.3 Description: The issue allows bypassing E-mail verification required for OAuth Flow. Recommendations: For versions prior to 13.0.12, update to...

FreeBSD : Gitlab -- Multiple Vulnerabilities (a003b74f-d7b3-11ea-9df1-001b217b3468)

Gitlab reports : Arbitrary File Read when Moving an Issue Memory Exhaustion via Excessive Logging of Invite Email Error Denial of Service Through Project Import Feature User Controlled Git Configuration Settings Resulting in SSRF Stored XSS in Issue Reference Number Tooltip Stored XSS in Issues...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary File Read when Moving an Issue Memory Exhaustion via Excessive Logging of Invite Email Error Denial of Service Through Project Import Feature User Controlled Git Configuration Settings Resulting in SSRF Stored XSS in Issue Reference Number Tooltip Stored XSS in Issues Li...

Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass

The plugin is affected by a loose comparison issue, which could allow any user to log in as administrator. An attacker can manipulate $GET'algwcevverifyemail' and set this payload: eyJpZCI6MSwiY29kZSI6MH0= Example: https://example.com/my-account/?algwcevverifyemail=eyJpZCI6MSwiY29kZSI6MH0= after...

WordPress Email Verification for WooCommerce plugin <= 1.8.1 - Bypass vulnerability

Bypass vulnerability discovered by WordPress Email Verification for WooCommerce plugin versions = 1.8.1. Solution Update the WordPress Email Verification for WooCommerce plugin to the latest available version at least 1.8.2...

GitLab: Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties

Summary There's a limitation that requires a validated email before going through the OAuth flow, however this is bypassable. Bypassing this means the target site assumes your email is validated, and actually ends up signing you in with an non-validated email. This behavior can frequently lead to...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35344)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, prior to 3.7.5, and prior to 3.6.7, which stems from the program's use of weak hashing algorithms for email invitations,...

CVE-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13265

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13265

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

Design/Logic Flaw

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13265

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13275

Removed by vendor...

CVE-2020-13275

CVE-2020-13275 affects GitLab EE versions 12.2–13.0.1. The vulnerability is an authorization issue where a user with an unverified email address could request access to domain‑restricted groups. The connected documents corroborate the affected versions and the access impact; no remediation detail...

CVE-2020-13265

Removed by vendor...

CVE-2020-13265

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13265

CVE-2020-13265 affects GitLab CE/EE, specifically versions 12.5 through 13.0.1, where a flaw allows bypassing email verification. The connected documents (Red Hat, OSV, NVD, CNVD, Nessus NASL, and others) consistently describe this as a user email verification bypass vulnerability in GitLab. The ...

CVE-2016-11062

An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed...

CVE-2016-11062

Mattermost Server prior to 3.5.1 is affected by CVE-2016-11062, where email address verification can be bypassed. This vulnerability is described across multiple sources (NVD, Red Hat, CNVD, OSV, etc.). The available documents do not provide concrete exploitation details, impact specifics beyond ...

CVE-2016-11062

An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed...