CVE-2019-15580

Removed by vendor...

CVE-2019-15580

CVE-2019-15580 is an information exposure vulnerability in gitlab.com versions <12.3.2, <12.2.6, and

CVE-2019-18452

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions...

CVE-2019-18452

An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions...

GitLab: Milestones leaked via search API

GitLab allows to restrict the project features for public projects. When disabling all features of a public project for non-project members under https://gitlab.com/xanbanx/test-search/edit, full access to milestones is still possible via the search API. Steps To Reproduce: Reproduced on GitLab...

GitLab: Confidential issues leaked in public projects when attached to milestone

Vulnerability details When a confidential issue in a public or internal project is attached to a milestone, it is exposed through the GitLab API. Proof of concept As a victim, create a new public or internal project. Lets state that the project has ID 1. Create a milestone for this project. After...

GitLab: Persistent XSS on public project page

Details A project admin can set up a custom issue tracker integration. This setting misses a check to make sure that it's a real URL and, thus, can use the javascript handler to execute arbitrary Javascript. Browsers use this handler to execute inline Javascript. This can lead to an account take...

Jeremiah Grossman on the Aviator Browser

Dennis Fisher talks with Jeremiah Grossman of WhiteHat Security about the company’s new Aviator browser, which employees have used for years, but the company just released as a public project. digitalunderground130.mp3...