CVE-2019-6789: Improper Privilege Management

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 4 of 6. In some cases, users without project permissions will receive emails after a project move. For private projects, this wi...

CVE-2019-11545: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue...

PT-2019-18379

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 9.x through 11.7.x before 11.7.1 GitLab Community and Enterprise Edition versions 11.6.x before 11.6.6 GitLab Community and Enterprise Edition version 11.5.8 and earlier Description The issue...

PT-2019-12372

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 9.x through 11.10.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2 Description An issue in Gitaly allows an information disclosure where HTTP/GIT credentials are included in lo...

PT-2019-18456

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.9 through 11.7.x GitLab Community and Enterprise Edition versions 11.6.x through 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x through 11.7.1 Description The issue concerns...

PT-2019-12369

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 GitLab Community and Enterprise Edition versions 11.9.x prior to 11.9.10 GitLab Community and Enterprise Edition versions 11.10.x prior to 11.10.2 Description The issue is relate...

CVE-2019-14943: Use of Hard-coded Credentials

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials...

PT-2019-13881

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.1.6 Description The issue involves the use of hard-coded credentials. Recommendations For versions 12.0 through 12.1.6, update to a version that does not use hard-coded credentia...

GitLab EE Authorization Issues Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A security...

Gitlab CE/EE Incorrect Access Control Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An incorre...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2019-23576)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...

GitLab CE/EE Incorrect Access Control Vulnerability (CNVD-2019-23573)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An incorre...

GitLab CE/EE server-side request forgery vulnerability (CNVD-2019-23579)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2019-23580)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...

CVE-2018-19496

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone...

CVE-2018-19495

An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration...

CVE-2018-19494

An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names...

CVE-2018-19493

An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding...

PT-2019-9857 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.6 up to 11.3.10 GitLab CE/EE versions 11.4 up to 11.4.7 GitLab CE/EE versions 11.5 up to 11.5.0 Description: The issue is related to an XSS vulnerability in the OAuth authorization page. Recommendations: For GitLab CE/...

CVE-2018-19496: Improper Access Control

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone...