PT-2020-9722 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2.2 and earlier Description: The issue allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. Recommendations: For GitLab versions 12.2.2 and earlier, update t...

CVE-2019-15579

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE where the assignees of a confidential issue in a private project would be disclosed to a guest via milestones...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

Design/Logic Flaw

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

CVE-2020-6832

Removed by vendor...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

GitLab: Elasticsearch leaks data through the notes scope

Summary The Elasticsearch results, when filtering using the notes scope, leaks data about private groups, private projects, and private issues. Steps to reproduce 1. Search, as an anonymous user, nextbit in the Gitlab group, filtering for "comments" link 2. You will have as result a private note...

Information disclosure

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 4 of 6. In some cases, users without project permissions will receive emails after a project move. For private projects, this wi...

FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)

Gitlab reports : DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control 'move issue' Guest users of private projects have access to releases DoS potential on project languages page Recuri...

GitLab: Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR)

Summary & Description : If you have a private project or private group then no non member should be able to access any information.But Adding Labels in your Private boards API request is vulnerable to IDOR attack which is leading to add private group/project labels and access it. Vulnerable Reque...

[SECURITY] [DSA 4206-1] gitlab security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4206-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 21, 2018 https://www.debian.org/security/faq -...

GitLab -- multiple vulnerabilities

GitLab reports: User without access to private Wiki can see it on the project page Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission. E-mail address disclosure through member search fields Hugo Geoffro...

CVE-2017-15208

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user...

CVE-2017-15204

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user...

Design/Logic Flaw

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user...

Kanboard Design Vulnerability (CNVD-2017-30945)

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.47. An...

Kanboard Design Vulnerability (CNVD-2017-30939)

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.47. An...

Kanboard Design Vulnerability (CNVD-2017-30943)

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.47. An...

Kanboard Design Vulnerability (CNVD-2017-30947)

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.47. An...