CVE-2019-5883

Removed by vendor...

PT-2019-17841

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 6.0 through 11.3.10 GitLab Community and Enterprise Edition versions 11.4.0 through 11.4.7 GitLab Community and Enterprise Edition versions 11.5.0 through 11.5.0 Description An issue was...

GitLab: DoS attack via comment on Issue

Summary There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE: This bug happens on GitLab.com. Steps to reproduce ▼Attack for Client-side 1. Sign in to GitLab. 2. Create a project as below: -...

GitLab: Unfiltered `class` attribute in markdown code

This affects merge request/issue comments and probably other parts of the user interface. I am demonstrating PoCs on GitLab.com itself, as they don't affect anything outside of my test repo, which is private. It could be used to execute some js actions by contructing content that uses the...