Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

UBUNTU-CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

CVE-2018-16049

CVE-2018-16049 affects GitLab Community/Enterprise Edition prior to 11.0.6, 11.1.x prior to 11.1.5, and 11.2.x prior to 11.2.2. The vulnerability results in Sensitive Data Disclosure in Sidekiq Logs via an error message, with the impact described as partial confidentiality (I) and high severity i...

CVE-2018-16049

Removed by vendor...

CVE-2018-16049: Insertion of Sensitive Information into Log File

An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message...

PT-2018-13387

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.0.0 through 11.0.6 GitLab Community and Enterprise Edition versions 11.1.x through 11.1.5 GitLab Community and Enterprise Edition versions 11.2.x through 11.2.2 Description The issue concerns...

GitLab: Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook

The secret token field of a webhook is vulnerable to a new line injection, allowing an attacker to inject non-HTTP commands in a TCP stream. When a GitLab instance is configured with an external Redis instance, e.g. on 127.0.0.1:6379, it may result in arbitrary code execution on a Sidekiq worker ...

GitLab: Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution

Test Conditions ============= This issue was tested in GitLab Community Edition using a combination of code review against git commit 6c65b63ca5, April 20 2017 and testing likely issues against a local deployment of Bitnami GitLab Community Edition 9.0.5-0, running on Ubuntu 14.04.5. These are...

GitLab: Race condition in GitLab import, giving access to other people their imports due to filename collision

Vulnerability details There's a race condition in the Import::GitlabProjectsControllercreate endpoint that allows an attacker to gain access to someone else's import file. The race condition happens when there's a collision in two or more file names uploaded at the same time, before the import ge...

HellRaiser - Vulnerability Scanner

Install Install ruby, bundler and rails. https://gorails.com/setup/ubuntu/16.04 Install redis-server and nmap. sudo apt-get update sudo apt-get install redis-server nmap Clone HellRaiser repository, change to hellraiser web app directory and run bundle install. git clone...

Contributed Systems RubyGems Sidekiq Cross-Site Scripting Vulnerability

Contributed Systems Sidekiq is a Ruby-based background processor that provides an efficient message queuing system for Rails 3 applications. A cross-site scripting vulnerability exists in Contributed Systems Sidekiq, which allows remote attackers to exploit the vulnerability to inject malicious...

Contributed Systems Sidekiq Cross-Site Request Forgery Vulnerability

Contributed Systems Sidekiq is a Ruby-based background processor that provides an efficient message queuing system for Rails 3 applications. A cross-site request forgery vulnerability exists in Contributed Systems Sidekiq, which allows a remote attacker to construct a malicious URI, trick a user...