PT-2018-5149

Name of the Vulnerable Software and Affected Versions Gitlab Enterprise Edition version 10.3 Description The issue is related to an authorization bypass in the GitLab Projects::BoardsController component. This results in an information disclosure on any board object. Recommendations For Gitlab...

CVE-2017-0922: Authorization Bypass Through User-Controlled Key

Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object...

PT-2018-5152

Name of the Vulnerable Software and Affected Versions Gitlab Enterprise Edition version 10.1.0 Description The issue concerns an insufficiently protected credential problem in the "project service integration API endpoint" that results in the disclosure of plaintext password information...

GitLab Arbitrary Code Execution Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has features similar to Github, with access to a project's file contents, commit history, bug list, etc. GitLab Community Edition CE is the...

CVE-2017-12426

GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import...

PT-2017-12551

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 8.17.8 GitLab Community Edition CE and Enterprise Edition EE versions 9.0.x through 9.0.12 GitLab Community Edition CE and Enterprise Edition EE versions 9.1.x through 9.1...

CVE-2017-12426: Improper Input Validation

GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import...

CVE-2017-11438

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11437

GitLab Enterprise Edition EE before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users...

PT-2017-12012

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 9.0.11, 9.1.8, 9.2.8 Description The issue allows an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

PT-2017-12011

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions prior to 8.17.7 GitLab Enterprise Edition EE versions prior to 9.0.11 GitLab Enterprise Edition EE versions prior to 9.1.8 GitLab Enterprise Edition EE versions prior to 9.2.8 GitLab Enterprise Edition EE...

CVE-2017-11438: Improper Privilege Management

GitLab Community Edition CE and Enterprise Edition EE before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup...

CVE-2017-11437: Incorrect Permission Assignment for Critical Resource

GitLab Enterprise Edition EE before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users...

CVE-2014-3456

Cross-site scripting XSS vulnerability in GitLab Enterprise Edition EE 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3456: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in GitLab Enterprise Edition EE 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-5335

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions 6.6.0 through 6.6.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For GitLab Enterprise Edition EE versions 6.6.0 through 6.6....