GitLab Information Disclosure Vulnerability (CNVD-2021-26075)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An information disclosure vulnerability exists in GitLab that stems from membership changes not bei...

CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab =7.12 allows a user to delete own account without deleting/transferring their group...

CVE-2020-13346

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API...

CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab =7.12 allows a user to delete own account without deleting/transferring their group...

CVE-2020-13346

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API...

CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab =7.12 allows a user to delete own account without deleting/transferring their group...

UBUNTU-CVE-2020-13346

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API...

UBUNTU-CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab =7.12 allows a user to delete own account without deleting/transferring their group...

CVE-2020-13346

Removed by vendor...

CVE-2020-13335

Removed by vendor...

CVE-2020-13335

GitLab CVE-2020-13335: Improper group membership validation when deleting a user account in GitLab versions >= 7.12 can allow a user to delete their own account without deleting or transferring their group. The common description across connected sources matches this flaw and its scope, identi...

PT-2020-13476 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 7.12 and later Description: The issue arises from improper group membership validation when a user account is deleted in GitLab. This allows a user to delete their own account without deleting or transferring their group...

Arbitrary Code Execution

gce-compute-image-packages is vulnerable to arbitrary code execution. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems, and to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges...

Shanghai ShangPai Network Technology Co., Ltd. Ecshop Has Logic Flaw Vulnerability

Commercial ECShop - new retail open source mall system, commercial B2C open source mall system, support for PC + H5 + APP + small program mall, source code free download, suitable for enterprises to quickly build a mall website, support for two open customization. And ECShop new upgrade ECShopX,...

CIS Releases 2019 Year in Review

The Center for Internet Security CIS has released its 2019 Year in Review. CIS is home to the Multi-State Information Sharing & Analysis Center MS-ISAC, a Cybersecurity and Infrastructure Security Agency CISA partner focused on cyber threat prevention, protection, response, and recovery for U.S...

CVE-2020-15120

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's...

CVE-2020-8907

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and...

GitLab: Todos are not redacted when membership changes - Access to (confidential) issues and merge requests

Summary This vulnerability was fixed in https://gitlab.com/gitlab-org/gitlab-foss/-/issues/54349 , but it reappears maybe due to some new changes and one is able to reproduce the vulnerability to access confidential issues and MRs. All issues and MRs used to get redacted after one hour grace peri...

Linux: Ensure that only system accounts and system administrations have membership of the system team

A user in a group can access and unintentionally or maliciously modify another uers SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

FreeBSD : Gitlab -- Multiple Vulnerabilities (570706ff-7ee0-11ea-bd0b-001b217b3468)

Gitlab reports : NuGet Package and File Disclosure through GitLab Workhorse Job Artifact Uploads and File Disclosure through GitLab Workhorse Incorrect membership following group removal Logging of Praefect tokens Update Rack dependency Update OpenSSL dependency C Tenable Network Security, Inc. T...