CVE-2020-7971: Improper Neutralization of Input During Web Page Generation

GitLab EE 11.0 and later through 12.7.2 allows XSS...

CVE-2020-7979: Incorrect Default Permissions

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

CVE-2020-7968: Missing Authorization

GitLab EE 8.0 through 12.7.2 has Incorrect Access Control...

CVE-2020-7976: Undefined Security Weakness

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control...

CVE-2020-7978: Undefined Security Weakness

GitLab EE 12.6 and later through 12.7.2 allows Denial of Service...

CVE-2020-7967: Incorrect Default Permissions

GitLab EE 8.0 through 12.7.2 has Insecure Permissions issue 1 of 2...

CVE-2020-7972: Incorrect Default Permissions

GitLab EE 12.2 has Insecure Permissions issue 2 of 2...

CVE-2020-6833: Undefined Security Weakness

An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...

CVE-2020-7977: Incorrect Default Permissions

GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions...

CVE-2020-8114: Incorrect Default Permissions

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

CVE-2020-7969: Undefined Security Weakness

GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure...

CVE-2019-15583

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API...

CVE-2019-5474

CVE-2019-5474 concerns GitLab EE: an authorization flaw in versions earlier than 12.1.2, 12.0.4, and 11.11.6 allows merge request approval rules to be overridden without proper permissions. The connected records consistently describe the issue as an authorization problem affecting the merge reque...

CVE-2019-5474

Removed by vendor...

CVE-2019-5474: Improper Access Control

An authorization issue was discovered in GitLab EE 12.1.2, 12.0.4, and 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

Remote code execution

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19628: Improper Limitation of a Pathname to a Restricted Directory

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19629: Undefined Security Weakness

In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration...