238 matches found
CVE-2020-13264
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...
Code injection
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...
CVE-2020-13264
Removed by vendor...
PT-2020-13405 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.3 through 13.0.1 Description: The issue allows other group maintainers to view Kubernetes cluster tokens, potentially leading to unauthorized access. Recommendations: For GitLab CE/EE versions 10.3 through 13.0.1,...
TeaBreak - A Productivity Burp Extension Which Reminds To Take Break While You Are At Work!
TeaBreak is a simple burp extension for security researchers and bug bounty hunters for helping them to increase their work productivity. We know how much health is important. It is recommended to take break from your work to avoid burnout, reduce eye strain and other health problems. How? Set yo...
CVE-2020-13976
An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it...
GitLab: Insufficient Type Check on GraphQL leading to Maintainer delete repository
Summary As you have know, Maintainer cannot delete/archive repository. But via GraphQL, they can do as there exists an sufficient check on GraphQL API app/graphql/mutations/snippets/destroy.rb ruby def resolveid: snippet = authorizedfind!id: id response = ::Snippets::DestroyService.newcurrentuser...
CVE-2020-10981
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
CVE-2020-10981
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
Design/Logic Flaw
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
CVE-2020-10981
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
CVE-2020-10981
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...
CVE-2020-10981
GitLab CE/EE versions 9.0–12.9 are affected by CVE-2020-10981, which allows a project maintainer to modify other maintainers’ pipeline trigger descriptions within the same project. The issue is tied to GitLab’s 12.9.x series and is documented with public advisories (see GitLab security releases)....
PT-2020-12466 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 9.0 through 12.9 Description: The issue allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. Recommendations: For GitLab EE/CE versions 9.0 through 12.9, consider...
CVE-2019-5472
An authorization issue was discovered in Gitlab versions 12.1.2, 12.0.4, and 11.11.6 that prevented owners and maintainer to delete epic comments...
CVE-2019-15582
Removed by vendor...
FreeBSD : Gitlab -- Multiple Vulnerabilities (01bde18a-2e09-11ea-a935-001b217b3468)
SO-AND-SO reports : Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in the...
Gitlab -- Multiple Vulnerabilities
The GitLab Team reports: Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in t...
DRUPAL-CONTRIB-2019-088
Update: This module had an access bypass vulnerability which has now been addressed by the module’s current maintainers. Original description The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you...