CVE-2019-11544

Removed by vendor...

CVE-2019-11546: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge...

PT-2019-18406

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.7 through 11.7.x GitLab Community and Enterprise Edition versions 11.6.x through 11.6.5 GitLab Community and Enterprise Edition versions 11.5.x through 11.5.7 Description The issue concerns...

CVE-2019-11549: Insertion of Sensitive Information into Log File

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors...

PT-2019-18343

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue allows for a persistent XSS due to a lack of input validation and output encoding when processing KaTeX in...

CVE-2019-6785: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service...

PT-2019-18341

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue allows information disclosure due to an authorization problem, enabling the contributed project information o...

PT-2019-12412

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8.x through 11.8.9 GitLab Community and Enterprise Edition versions 11.9.x through 11.9.10 GitLab Community and Enterprise Edition versions 11.10.x through 11.10.2 Description An issue allows...

CVE-2019-7176: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 8.x starting in 8.9, 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility...

PT-2019-18348

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue allows information disclosure, where users without project permissions may receive emails after a project mov...

PT-2019-18351

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue allows Path Disclosure. When an error occurs during project import, the error message displays internal...

CVE-2019-6784: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 1 of 2. Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS...

CVE-2019-11544: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository...

PT-2019-12368

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions 11.9.x through 11.9.9 GitLab Community Edition versions 11.10.x through 11.10.1 Description An issue allows information disclosure when an issue is moved to a private project, leaking the private project...

PT-2019-18345

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.5.8 and earlier, 11.6.x before 11.6.6, 11.7.x before 11.7.1 Description The issue concerns incorrect access control, allowing unauthorized users to access the contents of an LFS object if the...

PT-2019-18404

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.x through 11.7.x before 11.7.1 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.5 GitLab Community and Enterprise Edition version 11.5.7 and earlier Description The issue i...

CVE-2019-6995: Improper Preservation of Permissions

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...

PT-2019-12371

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 Description The issue is related to Incorrect Access Control, allowing unprivileged members of a project to post comments on confidential issues. This is due to an authorization...

PT-2019-12370

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8.x through 11.8.8 GitLab Community and Enterprise Edition versions 11.9.x through 11.9.9 GitLab Community and Enterprise Edition versions 11.10.x through 11.10.1 Description The issue is...

CVE-2019-6795: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social...