PT-2020-11133

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.0 and later Description A privilege escalation issue was discovered when trigger tokens are not rotated once ownership of them has changed. Recommendations For GitLab CE/EE versions 9.0 and later, rotate trigger tokens...

PT-2020-9718

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...

CVE-2020-5197

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20146

Removed by vendor...

CVE-2019-15577

An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed project milestones to be disclosed via groups browsing...

CVE-2019-15575

A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...

CVE-2019-15576

An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...

CVE-2019-5486

Removed by vendor...

CVE-2019-15575: Improper Neutralization of Special Elements used in a Command

A command injection exists in GitLab CE/EE...

PT-2019-14291

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description A command injection issue exists that allows an attacker to inject commands via the API through the blobs scope...

PT-2019-14292

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows an attacker to view private system notes from a GraphQL endpoint...

CVE-2019-15576: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exists in GitLab CE/EE...

CVE-2019-15577: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exists in GitLab CE/EE...

PT-2019-14293

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows project milestones to be disclosed via groups browsing...

CVE-2019-5486: Authentication Bypass Using an Alternate Path or Channel

A authentication bypass vulnerability exists in GitLab CE/EE...

PT-2019-17704

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description A authentication bypass vulnerability exists in the Salesforce login integration that could be used by an attacker t...

Design/Logic Flaw

An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-5467

An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...