PT-2019-14294

Name of the Vulnerable Software and Affected Versions gitlab versions prior to 12.3.2 gitlab versions prior to 12.2.6 gitlab versions prior to 12.1.10 Description An information exposure issue exists when using the blocking merge request feature. It allows an unauthenticated user to see the head...

PT-2019-14297

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 12.3.3 Description An issue exists that allows an attacker to bypass access controls and obtain container and dependency scanning reports through the merge request widget, even when public pipelines are disabled...

CVE-2019-15591: Improper Access Control

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...

GitLab: Stored XSS in merge request pages

A stored cross-site scripting XSS vulnerability was discovered in GitLab merge request pages. An attacker could exploit this vulnerability by creating a merge request with a specially crafted branch name and tricking a user with insufficient permissions to view the merge request page. This could...

CVE-2019-15729

An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request...

CVE-2019-15729

Removed by vendor...

CVE-2019-15729: Incorrect Authorization

An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request...

CVE-2019-15738

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

CVE-2019-15738

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

CVE-2019-15723

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

CVE-2019-15738

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

CVE-2019-15738

Removed by vendor...

CVE-2019-15731

CVE-2019-15731 affects GitLab Community and Enterprise Edition 12.0–12.2.1. The issue allows non-members to comment on merge requests even when the repository is configured to permit comments only from project members. Root cause details are not explicitly provided in the connected documents beyo...

PT-2019-14359

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered where merge request IDs were being disclosed via email under certain conditions. Recommendations For GitLab Community and Enterprise Editi...

CVE-2019-15738: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

CVE-2019-6997

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6996

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

CVE-2019-6996

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

Improper access control

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...