CVE-2019-5474

An authorization issue was discovered in GitLab EE 12.1.2, 12.0.4, and 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions...

CVE-2019-15578

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

CVE-2019-15590

An access control issue exists in 12.3.5, 12.2.8, and 12.1.14 for GitLab Community Edition CE and Enterprise Edition EE where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration...

CVE-2019-15590

Removed by vendor...

CVE-2019-5474

CVE-2019-5474 concerns GitLab EE: an authorization flaw in versions earlier than 12.1.2, 12.0.4, and 11.11.6 allows merge request approval rules to be overridden without proper permissions. The connected records consistently describe the issue as an authorization problem affecting the merge reque...

CVE-2019-5474

Removed by vendor...

GitLab CE and EE Incorrect Access Control Vulnerability (CNVD-2020-03844)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE and EE 11.4...

FreeBSD : Gitlab -- Multiple Vulnerabilities (01bde18a-2e09-11ea-a935-001b217b3468)

SO-AND-SO reports : Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in the...

Gitlab -- Multiple Vulnerabilities

The GitLab Team reports: Group Maintainers Can Update/Delete Group Runners Using API GraphQL Queries Can Hang the Application Unauthorized Users Have Access to Milestones of Releases Private Group Name Revealed Through Protected Tags API Users Can Publish Reviews on Locked Merge Requests DoS in t...

Top 7 PDF Tools to Edit, Merge/Split and Protect PDF

By Uzair Amir This article showcases the Top 7 PDF tools so let's get into it. This is a post from HackRead.com Read the original post: Top 7 PDF Tools to Edit, Merge/Split and Protect PDF...

CVE-2019-5487

An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...

CVE-2019-15580

An information exposure vulnerability exists in gitlab.com v12.3.2, v12.2.6, and v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted...

CVE-2019-5487

An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...

CVE-2019-5487

The CVE-2019-5487 entry concerns an improper access control in GitLab Enterprise Edition (GitLab EE) prior to v12.3.3, v12.2.7, and v12.1.13. The vulnerability arises in the group search feature when used with Elasticsearch, allowing leakage of private data (private code, merge requests, commits)...

CVE-2019-5487

Removed by vendor...

CVE-2019-15580

Removed by vendor...

CVE-2019-15591

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...

ffmpeg:ffmpeg_BSF_AV1_FRAME_MERGE_fuzzer: Index-out-of-bounds in cbs_av1_read_film_grain_params

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5747424845103104 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFAV1FRAMEMERGEfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

Prototype Pollution

angularjs is vulnerable to prototype pollution. An attacker is able to add or modify properties of the Object.prototype by using a malicious proto object in the merge function, resulting in possible execution of arbitrary code...

AngularJS Input Validation Error Vulnerability

AngularJS is a TypeScript-based open source web application framework. An input validation error vulnerability exists in AngularJS versions prior to 1.7.9, which can be exploited by an attacker via the proto payload to trick the merge function into adding or modifying properties of Object.prototy...