GitLab CE/EE Information Disclosure Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. An information...

CVE-2018-17976

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-17975

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

UBUNTU-CVE-2018-18646

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF...

CVE-2018-17976

CVE-2018-17976 affects GitLab Community Edition 11.x (before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2). The vulnerability enables information exposure through Epic change descriptions in the Epic feature. Affected versions expose partial to high-privacy data (as per the CVE and rela...

PT-2018-14310

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions 11.0.0 through 11.1.8 GitLab Community Edition versions 11.2.0 through 11.2.5 GitLab Community Edition versions 11.3.0 through 11.3.2 Description An issue was discovered that leads to Information Exposure via...

PT-2018-14309

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions 11.0.0 through 11.1.8 GitLab Community Edition versions 11.2.0 through 11.2.5 GitLab Community Edition versions 11.3.0 through 11.3.2 Description An issue was discovered that leads to Information Exposure via...

CVE-2018-18642: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS...

CVE-2018-17975: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API...

CVE-2018-18646: Server-Side Request Forgery (SSRF)

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF...

CVE-2018-17976: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions...

CVE-2018-18649: Undefined Security Weakness

An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for remote code execution...

CVE-2018-12607

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding...

CVE-2018-12606

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...

CVE-2018-12607: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding...

CVE-2018-12605: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'urlfor' contained a XSS issue due to it allowing arbitrary protocols as a parameter...

PT-2018-11286

Name of the Vulnerable Software and Affected Versions GitLab Community Edition and Enterprise Edition versions 10.7.x through 10.7.5 Description An issue was discovered due to the usage of url for which contained a XSS issue. This was caused by url for allowing arbitrary protocols as a parameter...

PT-2018-11288

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions prior to 10.7.6 GitLab Community Edition versions 10.8.x prior to 10.8.5 GitLab Community Edition versions 11.x prior to 11.0.1 GitLab Enterprise Edition versions prior to 10.7.6 GitLab Enterprise Edition...

CVE-2018-12606: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...