CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-7353

Removed by vendor...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

Removed by vendor...

CVE-2019-6790: Missing Authorization

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-7353: Exposure of Sensitive Information to an Unauthorized Actor

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

PT-2019-18349

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.14 through 11.5.8 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x through 11.7.1 Description An issue of incorrec...

GitLab: Last pipeline status for MR leaked

Hi GitLab security team, Summary GitLab allows for public and internal projects to restrict the visibility of pipelines to project members only. Then, only project members should have access to the pipeline information. However, this can be bypassed. There is a internal endpoint...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated attacker could exploit a flaw in the Merge component to cause denial of service conditions...

Cross site scripting

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

CVE-2019-10111

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

CVE-2019-10111

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

CVE-2019-10111

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

CVE-2019-10111

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

CVE-2019-10111

Removed by vendor...

CVE-2019-10111: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...

PT-2019-11574

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.7.8 and earlier, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 GitLab Community and Enterprise Edition versions 11.7.10 and earlier, 11.8.x before 11.8.6, and 11.9.x before 11.9.4...

Prototype Pollution

Overview All versions of upmerge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with othe...