PT-2019-14357

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.2.2 Description An issue was discovered that could potentially be used in a denial of service attack under certain circumstances, specifically through CI pipelines. Recommendations F...

PT-2019-14350

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.1 through 12.2.1 Description An issue was discovered where protections against SSRF attacks on the Kubernetes integration are insufficient. This could have allowed an attacker to request any...

PT-2019-14345

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.9.x through 11.10.x Description An issue was discovered that could allow merge requests created by email to bypass push rules in certain situations. Recommendations For GitLab Community and...

PT-2019-14360

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.1 through 12.2.1 Description An issue was discovered where certain areas displaying Markdown were not properly sanitizing some XSS payloads. Recommendations For GitLab Community and Enterprise...

CVE-2019-15732: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions...

PT-2019-14346

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.10 through 12.2.1 Description An issue was discovered that makes label descriptions vulnerable to HTML injection. Recommendations For GitLab Community and Enterprise Edition versions 11.10...

PT-2019-14354

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.2 through 12.2.1 Description An issue was discovered that allows bypassing project visibility restrictions through the project import API. Recommendations For GitLab Community and Enterprise...

PT-2019-14347

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered that could result in disclosure of private milestones, labels, and other information due to an IDOR in the epic notes API. Recommendations...

CVE-2019-15722: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources...

CVE-2019-15725: Authorization Bypass Through User-Controlled Key

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information...

PT-2019-14361

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 7.9 through 12.2.1 Description An issue was discovered where EXIF Geolocation data was not being removed from certain image uploads. Recommendations For versions 7.9 through 12.2.1, consider...

CVE-2019-15736: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

CVE-2019-15724: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection...

CVE-2019-15727: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users...

PT-2019-14349

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.2 through 12.2.1 Description An issue was discovered where insufficient permission checks were applied when displaying CI results. This could potentially expose some CI metrics data to...

CVE-2019-15734: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

CVE-2019-15721: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings...

PT-2019-14358

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.2.2 GitLab Community and Enterprise Edition versions through 12.2.1 Description An issue was discovered in certain account actions that needed improved authentication and session...

PT-2019-14359

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered where merge request IDs were being disclosed via email under certain conditions. Recommendations For GitLab Community and Enterprise Editi...

GitLab Input Validation Error Vulnerability (CNVD-2020-20441)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...