1682 matches found
CVE-2019-19629: Undefined Security Weakness
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration...
PT-2020-10134
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.4 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns the storage of several tokens in plaintext. Recommendations For GitLab EE versions 8.4 through 12.5, update to a version that...
CVE-2019-19314: Cleartext Storage of Sensitive Information
GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext...
CVE-2019-19313: Improper Handling of Exceptional Conditions
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...
PT-2020-10203
Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue is related to insufficient parameter sanitization for the Maven package registry, which could lead to privilege escalation and remot...
PT-2020-10204
Name of the Vulnerable Software and Affected Versions GitLab EE versions 10.5 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue allows private code to be disclosed via the Group Search API provided by the Elasticsearch integration when transferring a public...
PT-2020-10132
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns incorrect access control. After a project is changed to private, previously forked repositories can still access information...
CVE-2019-19628: Improper Limitation of a Pathname to a Restricted Directory
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19256
Removed by vendor...
CVE-2019-19311
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
CVE-2019-19311: Improper Neutralization of Input During Web Page Generation
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
PT-2020-10131
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue allows for XSS in group and profile fields. Recommendations For GitLab EE versions 8.14 through 12.5, update to a version outside of...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-5487: Improper Access Control
An improper access control vulnerability exists in Gitlab EE...
PT-2019-17705
Name of the Vulnerable Software and Affected Versions Gitlab EE versions prior to 12.3.3 Gitlab EE versions prior to 12.2.7 Gitlab EE versions prior to 12.1.13 Description An issue exists that allows the group search feature with Elasticsearch to return private code, merge requests, and commits d...
CVE-2019-5467
An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...
PT-2019-17692 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 11.11.6 GitLab CE/EE versions prior to 12.0.4 GitLab CE/EE versions prior to 12.1.2 Description: An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature, which could...
CVE-2018-19584
GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups...