PT-2019-15405

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.4 Description An issue was discovered that involves Incorrect Access Control. Recommendations For versions prior to 12.4, update to version 12.4 or later to resolve the issue...

PT-2019-15412

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11 through 12.4 Description An issue was discovered when building Nested GraphQL queries, which can cause a large or infinite loop. Recommendations For versions 11 through 12.4, consider...

PT-2019-15418

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.3 through 12.3 Description The issue concerns Incorrect Access Control. When a sub group epic is added to a public group, an issue arises. Recommendations For GitLab Community and Enterprise...

PT-2019-15414

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8 through 12.4 Description An issue was discovered in the handling of Security tokens, which has Insecure Permissions. Recommendations For GitLab Community and Enterprise Edition versions 11....

CVE-2019-18457: Improper Preservation of Permissions

An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions...

CVE-2019-18448: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control...

CVE-2019-18447: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions...

CVE-2019-18462: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions...

CVE-2019-18461: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control...

CVE-2019-18455: Loop with Unreachable Exit Condition

An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop...

CVE-2019-18451: URL Redirection to Untrusted Site

An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect...

CVE-2019-18454: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS...

CVE-2019-18446: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions issue 1 of 2...

PT-2019-15408

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.7.4 through 12.4 Description An issue was discovered in the InternalRedirect filtering feature, which has an Open Redirect. Recommendations For GitLab Community and Enterprise Edition version...

PT-2019-15410

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.6 through 12.4 Description An issue was discovered in the add comments via email feature, which has Insecure Permissions. Recommendations For GitLab Community and Enterprise Edition versions...

PT-2019-15413

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.17 through 12.4 Description An issue was discovered in the Search feature provided by Elasticsearch integration, related to Insecure Permissions. Recommendations For GitLab Community and...

PT-2019-15411

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.5 through 12.4 Description An issue was discovered in the link validation for RDoc wiki pages feature, which has a cross-site scripting XSS issue. Recommendations For versions 10.5 through...

CVE-2019-18460: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

CVE-2019-15729

An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request...

PT-2019-14351

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.18 through 12.2.1 Description An issue was discovered that unintentionally disclosed information about the last pipeline that ran for a merge request due to an internal endpoint. Recommendatio...