PT-2019-14357

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.2.2 Description An issue was discovered that could potentially be used in a denial of service attack under certain circumstances, specifically through CI pipelines. Recommendations F...

PT-2019-14355

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 7.12 through 12.2.1 Description An issue was discovered that could expose the specified default branch name to unauthorized users. Recommendations For GitLab Community and Enterprise Edition...

PT-2019-14345

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.9.x through 11.10.x Description An issue was discovered that could allow merge requests created by email to bypass push rules in certain situations. Recommendations For GitLab Community and...

CVE-2019-15732: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions...

PT-2019-14346

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.10 through 12.2.1 Description An issue was discovered that makes label descriptions vulnerable to HTML injection. Recommendations For GitLab Community and Enterprise Edition versions 11.10...

PT-2019-14354

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.2 through 12.2.1 Description An issue was discovered that allows bypassing project visibility restrictions through the project import API. Recommendations For GitLab Community and Enterprise...

PT-2019-14347

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered that could result in disclosure of private milestones, labels, and other information due to an IDOR in the epic notes API. Recommendations...

PT-2019-14350

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.1 through 12.2.1 Description An issue was discovered where protections against SSRF attacks on the Kubernetes integration are insufficient. This could have allowed an attacker to request any...

CVE-2019-15725: Authorization Bypass Through User-Controlled Key

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information...

PT-2019-14358

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.2.2 GitLab Community and Enterprise Edition versions through 12.2.1 Description An issue was discovered in certain account actions that needed improved authentication and session...

CVE-2019-15739: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads...

CVE-2019-15736: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

CVE-2019-15724: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection...

CVE-2019-15727: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users...

PT-2019-14349

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.2 through 12.2.1 Description An issue was discovered where insufficient permission checks were applied when displaying CI results. This could potentially expose some CI metrics data to...

PT-2019-14353

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered that allowed non-members to comment on merge requests, despite the repository settings restricting this action to project members only...

CVE-2019-15722: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources...

CVE-2019-15721: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings...

CVE-2019-15734: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

PT-2019-14360

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.1 through 12.2.1 Description An issue was discovered where certain areas displaying Markdown were not properly sanitizing some XSS payloads. Recommendations For GitLab Community and Enterprise...