CVE-2019-6995: Improper Preservation of Permissions

An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...

PT-2019-18379

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 9.x through 11.7.x before 11.7.1 GitLab Community and Enterprise Edition versions 11.6.x before 11.6.6 GitLab Community and Enterprise Edition version 11.5.8 and earlier Description The issue...

PT-2019-12370

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8.x through 11.8.8 GitLab Community and Enterprise Edition versions 11.9.x through 11.9.9 GitLab Community and Enterprise Edition versions 11.10.x through 11.10.1 Description The issue is...

CVE-2019-6795: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social...

PT-2019-12371

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 Description The issue is related to Incorrect Access Control, allowing unprivileged members of a project to post comments on confidential issues. This is due to an authorization...

PT-2019-18456

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.9 through 11.7.x GitLab Community and Enterprise Edition versions 11.6.x through 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x through 11.7.1 Description The issue concerns...

PT-2019-12369

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.8.9 GitLab Community and Enterprise Edition versions 11.9.x prior to 11.9.10 GitLab Community and Enterprise Edition versions 11.10.x prior to 11.10.2 Description The issue is relate...

PT-2019-18404

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.x through 11.7.x before 11.7.1 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.5 GitLab Community and Enterprise Edition version 11.5.7 and earlier Description The issue i...

CVE-2019-14943: Use of Hard-coded Credentials

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials...

PT-2019-13881

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.1.6 Description The issue involves the use of hard-coded credentials. Recommendations For versions 12.0 through 12.1.6, update to a version that does not use hard-coded credentia...

GitLab EE Authorization Issues Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A security...

Gitlab CE/EE Incorrect Access Control Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An incorre...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2019-23576)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...

GitLab CE/EE Incorrect Access Control Vulnerability (CNVD-2019-23573)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An incorre...

GitLab CE/EE server-side request forgery vulnerability (CNVD-2019-23579)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2019-23580)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A cross-si...

CVE-2018-19496

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone...

CVE-2018-19495

An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration...

CVE-2018-19494

An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names...

CVE-2018-19493

An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding...