3946 matches found
CVE-2020-10085
GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles...
CVE-2020-10085
Removed by vendor...
PT-2020-11910 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.3.5 through 12.8.1 Description: The issue allows information disclosure. A particular view was exposing merge private merge request titles. Recommendations: For GitLab versions 12.3.5 through 12.8.1, update to a version tha...
CVE-2020-10078: Improper Neutralization of Input During Web Page Generation
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability...
CVE-2020-10076: Improper Neutralization of Input During Web Page Generation
GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests...
CVE-2020-10085: Undefined Security Weakness
GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles...
PT-2020-11903 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 12.8.1 Description: The issue is related to a stored cross-site scripting vulnerability in the merge request submission form. This allows for XSS attacks. Recommendations: For GitLab versions 12.1 through 12.8.1,...
PT-2020-11901 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 12.8.1 Description: A stored cross-site scripting issue was found when displaying merge requests, allowing for XSS attacks. Recommendations: For versions 12.1 through 12.8.1, update to a version that contains a fi...
CVE-2019-10808
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...
CVE-2019-10808
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...
CVE-2019-10808
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...
CVE-2019-10808
CVE-2019-10808 affects utilitify prior to 1.0.3. The merge function can facilitate prototype pollution by adding or modifying properties on Object.prototype, enabling attackers to tamper with object hierarchies. This is documented across multiple sources (GHSA/Snyk and vendor advisories). remedia...
CVE-2019-10808: Improperly Controlled Modification of Object Prototype Attributes
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...
CVE-2019-13011
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...
CVE-2019-13011
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...
Code injection
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...
Improper access control
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control...
CVE-2019-13011
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...
CVE-2019-13011
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...