CVE-2019-15723

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

CVE-2019-15723

GitLab CVE-2019-15723 affects GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. The issue allows merge requests created by email to bypass push rules in certain situations, enabling potential unauthorized changes. Remediation is to upgrade to 11.10.1 or later (as the fixe...

PT-2019-14359

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered where merge request IDs were being disclosed via email under certain conditions. Recommendations For GitLab Community and Enterprise Editi...

CVE-2019-15731: Server-Side Request Forgery (SSRF)

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so...

CVE-2019-15723: Missing Authorization

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations...

CVE-2019-15738: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email...

PT-2019-14345

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.9.x through 11.10.x Description An issue was discovered that could allow merge requests created by email to bypass push rules in certain situations. Recommendations For GitLab Community and...

PT-2019-14353

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 12.0 through 12.2.1 Description An issue was discovered that allowed non-members to comment on merge requests, despite the repository settings restricting this action to project members only...

CVE-2019-6997

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6996

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

CVE-2019-6996

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

Improper access control

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

Command injection

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6997

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6997

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6997

GitLab CVE-2019-6997 affects GitLab Community and Enterprise Edition 10.x (from 10.7) and 11.x (before 11.5.8, 11.6.x before 11.6.6, 11.7.x before 11.7.1). The issue is an Incorrect Access Control in system notes that permits a guest user to view merge request titles. No exploitation details are ...

CVE-2019-6997

An issue was discovered in GitLab Community and Enterprise Edition 10.x starting in 10.7 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles...

CVE-2019-6997

Removed by vendor...

CVE-2019-6996

Removed by vendor...

CVE-2019-11546

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge...