PT-2019-19444

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.6.10 GitLab Community and Enterprise Edition versions 11.7.x prior to 11.7.6 GitLab Community and Enterprise Edition versions 11.8.x prior to 11.8.1 Description The issue is related ...

PT-2019-19441

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 11.6.10 GitLab Community and Enterprise Edition versions 11.7.x prior to 11.7.6 GitLab Community and Enterprise Edition versions 11.8.x prior to 11.8.1 Description The issue is related ...

CVE-2018-20500

An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leav...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-6781

An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails...

PT-2019-10093

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 9.4 through 11.4.12 GitLab Community and Enterprise Edition versions 11.5.x through 11.5.5 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.0 Description: An insecure...

PT-2019-18558

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.7.x through 11.7.3 Description An issue of incorrect access control was discovered, allowing users to view confidential issues and merge request titles of other projects due to an authorizati...

PT-2019-18349

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.14 through 11.5.8 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x through 11.7.1 Description An issue of incorrec...

CVE-2019-6781: URL Redirection to Untrusted Site

An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails...

CVE-2019-10114

An Information Exposure issue issue 2 of 2 was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing da...

CVE-2019-10117: URL Redirection to Untrusted Site

An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node...

CVE-2019-10114: Observable Discrepancy

An Information Exposure issue issue 2 of 2 was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing da...

PT-2019-11579

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions prior to 11.7.8 GitLab Community and Enterprise Edition versions 11.8.x prior to 11.8.4 GitLab Community and Enterprise Edition versions 11.9.x prior to 11.9.2 Description: An Insecure...

CVE-2019-10116: Incorrect Permission Assignment for Critical Resource

An Insecure Permissions issue issue 3 of 3 was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue...

GitLab CE and EE Information Disclosure Vulnerability (CNVD-2019-23581)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

PT-2019-11578

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions prior to 11.7.8 GitLab Community and Enterprise Edition versions 11.8.x prior to 11.8.4 GitLab Community and Enterprise Edition versions 11.9.x prior to 11.9.2 Description: An Insecure...

PT-2019-11575

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 GitLab Community and Enterprise Edition versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4...

Hardcoded credentials

An Insecure Permissions issue issue 1 of 3 was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credential...

CVE-2019-10110

An Insecure Permissions issue issue 1 of 3 was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credential...

CVE-2019-10640: Improper Neutralization of Special Elements used in a Command

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption...