Cross site request forgery (csrf)

An IDOR exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a project owner or maintainer to see the members of any private group via merge request approval rules...

Code injection

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

Code injection

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-5466

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-15582

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

CVE-2019-15581

An IDOR exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a project owner or maintainer to see the members of any private group via merge request approval rules...

CVE-2019-15581

GitLab CVE-2019-15581 describes an IDOR in GitLab CE/EE prior to certain patch levels (versions <12.3.2, <12.2.6,

CVE-2019-15581

Removed by vendor...

CVE-2019-5466

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-5466

Technical details about CVE-2019-5466 are not publicly provided in the connected documents. Monitor for updates from vendors (GitLab, Red Hat, Ubuntu, Debian, CVE List) for affected versions, impact, and remediation.

CVE-2019-5466

Removed by vendor...

CVE-2019-15582

CVE-2019-15582 affects GitLab Community Edition (CE) and Enterprise Edition (EE) prior to versions 12.3.2, 12.2.6, and 12.1.12. An IDOR was present that allowed a maintainer to add any private group to a protected environment, exposing potentially restricted group access. The vulnerability is des...

CVE-2019-15582

Removed by vendor...

CVE-2019-15582

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

PT-2020-9716

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...

PT-2020-9717

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2...

CVE-2019-15581: Authorization Bypass Through User-Controlled Key

An IDOR exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a project owner or maintainer to see the members of any private group via merge request approval rules...

CVE-2019-5466: Authorization Bypass Through User-Controlled Key

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-15582: Authorization Bypass Through User-Controlled Key

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

CarSpot < 2.2.3 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS - Registration Form/User Profile - Authenticated Persistent XSS - Ad Post - IDOR leading to arbitrary deletion of ads Edit WPScanTeam: January...