CVE-2018-12606

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...

PT-2018-11288

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions prior to 10.7.6 GitLab Community Edition versions 10.8.x prior to 10.8.5 GitLab Community Edition versions 11.x prior to 11.0.1 GitLab Enterprise Edition versions prior to 10.7.6 GitLab Enterprise Edition...

CVE-2018-12607: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding...

CVE-2018-12605: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'urlfor' contained a XSS issue due to it allowing arbitrary protocols as a parameter...

CVE-2018-12606: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature...

PT-2018-11287

Name of the Vulnerable Software and Affected Versions GitLab Community Edition versions prior to 10.7.6 GitLab Community Edition versions 10.8.x prior to 10.8.5 GitLab Community Edition versions 11.x prior to 11.0.1 GitLab Enterprise Edition versions prior to 10.7.6 GitLab Enterprise Edition...

PT-2018-11286

Name of the Vulnerable Software and Affected Versions GitLab Community Edition and Enterprise Edition versions 10.7.x through 10.7.5 Description An issue was discovered due to the usage of url for which contained a XSS issue. This was caused by url for allowing arbitrary protocols as a parameter...

CVE-2018-14606: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion...

CVE-2018-14364

GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component...

GitLab Community Edition and Enterprise Edition HTML Injection Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. An HTML injection...

CVE-2018-10379

Removed by vendor...

PT-2018-9860

Name of the Vulnerable Software and Affected Versions: GitLab Community Edition CE versions 10.5.x through 10.5.7 GitLab Community Edition CE versions 10.6.x through 10.6.4 GitLab Community Edition CE versions 10.7.x through 10.7.1 GitLab Enterprise Edition EE versions 10.5.x through 10.5.7 GitLa...

CVE-2018-10379: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability...

GitLab Enterprise Edition (EE) Unauthorized Repository Access Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to Github for accessing the contents of a project's files, commit history, bug lists, etc. GitLab Enterprise Edition EE is...

GitLab Community Edition (CE) and Enterprise Edition License Bypass Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to Github, with access to a project's file contents, commit history, bug list, etc. GitLab Community Edition CE is the...

Gitlab SQL Injection Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to those of Github, such as access to a project's file contents, commit history, bug lists, etc. GitLab Community Edition ...

CVE-2017-0922

Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object...

UBUNTU-CVE-2017-0925

Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password...

CVE-2017-0925

Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password...

CVE-2017-0925: Insufficiently Protected Credentials

Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password...