1288 matches found
CVE-2020-13269: Improper Neutralization of Input During Web Page Generation
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1...
CVE-2020-13270: Missing Authorization
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...
CVE-2020-13266
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...
CVE-2020-13266: Missing Authorization
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...
CVE-2019-12428
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...
CVE-2019-15586
A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...
CVE-2019-5466
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...
CVE-2019-15578
An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...
CVE-2019-15586
A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...
CVE-2019-15586
Removed by vendor...
CVE-2019-5465: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID...
CVE-2019-5464: Improper Input Validation
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the urlblocker.rb which could result in SSRF where the library is utilized...
CVE-2019-5462: Insufficient Session Expiration
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...
CVE-2019-5466: Authorization Bypass Through User-Controlled Key
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...
CVE-2019-15586: Improper Neutralization of Input During Web Page Generation
A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...
CVE-2019-20146
Removed by vendor...
CVE-2019-15576
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...
CVE-2019-15575
A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...