CVE-2017-0926: Improper Authorization

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

CVE-2017-0923: Improper Neutralization of Input During Web Page Generation

Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting...

CVE-2017-0927: Improper Authorization

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users...

CVE-2017-0917: Improper Neutralization of Input During Web Page Generation

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting...

PT-2018-5154

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to an improper authorization problem in the deployment keys component. This results in unauthorized use of deployment keys by guest users. Recommendations For Gitlab...

CVE-2017-0918: Relative Path Traversal

Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution...

CVE-2017-0915: Improper Neutralization of Special Elements used in a Command

Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution...

CVE-2017-0916: Improper Neutralization of Special Elements used in a Command

Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the systemhookpush queue through web hook component resulting in remote code execution...

PT-2018-5144

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.2.4 Description The issue is related to a lack of input validation in the CI job component, resulting in persistent cross-site scripting. This allows for malicious scripts to be injected and executed,...

PT-2018-5153

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to an improper authorization problem in the Oauth sign-in component, which can result in unauthorized user login. This allows unauthorized access to the system...

PT-2018-5145

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to a path traversal problem in the GitLab CI runner component, which results in remote code execution. Recommendations For Gitlab Community Edition version 10.3, update to ...

PT-2018-5143

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to a lack of input validation in the system hook push queue through the web hook component, resulting in remote code execution. Recommendations For Gitlab Community Edition...

PT-2018-5142

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.2.4 Description The issue is related to a lack of input validation in the GitlabProjectsImportService that results in remote code execution. Recommendations For Gitlab Community Edition version 10.2.4,...

GitLab Arbitrary Code Execution Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to Github, with access to a project's file contents, commit history, bug list, etc. GitLab Community Edition CE is the...

CVE-2017-12426

GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import...

PT-2017-12551

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 8.17.8 GitLab Community Edition CE and Enterprise Edition EE versions 9.0.x through 9.0.12 GitLab Community Edition CE and Enterprise Edition EE versions 9.1.x through 9.1...

CVE-2017-12426: Improper Input Validation

GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

PT-2017-12012

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 9.0.11, 9.1.8, 9.2.8 Description The issue allows an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11438: Improper Privilege Management

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...