CVE-2019-13006

An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control...

CVE-2019-13002

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control...

CVE-2019-13002

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control...

PT-2020-9361

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 9.0 through 12.0.2 Description: An issue was discovered that allows users with access to issues, but not the repository, to view the number of related merge requests on an issue. This is due to...

CVE-2019-13006: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control...

CVE-2019-13002: Undefined Security Weakness

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control...

PT-2020-9365

Name of the Vulnerable Software and Affected Versions: GitLab Enterprise Edition versions 8.11.0 through 12.0.2 Description: An issue was discovered that allows a user with access to a project, but not its repository, to create a list of merge requests template names using brute-force. The issue...

CVE-2019-13011: Uncontrolled Resource Consumption

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

PT-2020-9156 · Vega-Util · Vega-Util

Name of the Vulnerable Software and Affected Versions: vega-util versions prior to 1.13.1 Description: The issue allows manipulation of the object prototype. The vega.mergeConfig method within vega-util can be tricked into adding or modifying properties of the Object.prototype. Recommendations: F...

FreeBSD : Gitlab -- Multiple Vulnerabilities (62f2182c-5f7a-11ea-abb7-001b217b3468)

Gitlab reports : Directory Traversal to Arbitrary File Read Account Takeover Through Expired Link Server Side Request Forgery Through Deprecated Service Group Two-Factor Authentication Requirement Bypass Stored XSS in Merge Request Pages Stored XSS in Merge Request Submission Form Stored XSS in...

Prototype Pollution

Overview utilitify is a the utilities for working with a collections such as objects, arrays and primitives such as numbers, strings, etc. Affected versions of this package are vulnerable to Prototype Pollution. The merge method could be tricked into adding or modifying properties of...

Prototype Pollution

Overview bodymen is a Body parser middleware for MongoDB, Express and Nodejs. Affected versions of this package are vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a proto payload. PoC by JHU System Security La...

License compatibility and merge rules for Veeam Availability Suite v10/v11

The following describes general licensing, compatibility and merge rules for end users/customers. It shows the monitoring and reporting capabilities of Veeam ONE licensed perpetually per socket and...

CVE-2019-15594

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint...

CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

CVE-2019-15594

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint...

CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

CVE-2019-15594

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint...

Improper access control

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint...

Improper access control

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...