UBUNTU-CVE-2019-15736

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

CVE-2019-15723

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

CVE-2019-15737

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management...

CVE-2019-15736

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

CVE-2019-15732

An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions...

CVE-2019-15731

CVE-2019-15731 affects GitLab Community and Enterprise Edition 12.0–12.2.1. The issue allows non-members to comment on merge requests even when the repository is configured to permit comments only from project members. Root cause details are not explicitly provided in the connected documents beyo...

CVE-2019-15727

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users...

CVE-2019-15723

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

PT-2019-14353

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered that allowed non-members to comment on merge requests, despite the repository settings restricting this action to project members only...

CVE-2019-16170: Undefined Security Weakness

An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Control...

CVE-2019-15721: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings...

CVE-2019-15726: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server...

PT-2019-14348

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions prior to 12.2.2 Description An issue allows embedded images and media files in markdown to be pointed to an arbitrary server. This could reveal the IP address of clients requesting the file from...

PT-2019-14550

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 11.x through 12.2.x before 12.0.9, 12.1.9, and 12.2.5 GitLab Enterprise Edition versions 12.0 through 12.0.8 GitLab Enterprise Edition versions 12.1 through 12.1.8 GitLab Enterprise Edition versions 12.2...

CVE-2019-15722: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources...

CVE-2019-15725: Authorization Bypass Through User-Controlled Key

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information...

PT-2019-14346

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.10 through 12.2.1 Description An issue was discovered that makes label descriptions vulnerable to HTML injection. Recommendations For GitLab Community and Enterprise Edition versions 11.10...

CVE-2019-15736: Allocation of Resources Without Limits or Throttling

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

GitLab Input Validation Error Vulnerability (CNVD-2020-20441)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2019-32229)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...