PT-2019-12370

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.8.x through 11.8.8 GitLab Community and Enterprise Edition versions 11.9.x through 11.9.9 GitLab Community and Enterprise Edition versions 11.10.x through 11.10.1 Description The issue is...

CVE-2019-6996: Improper Privilege Management

An issue was discovered in GitLab Enterprise Edition 10.x starting in 10.6 and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership o...

PT-2019-18406

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 10.7 through 11.7.x GitLab Community and Enterprise Edition versions 11.6.x through 11.6.5 GitLab Community and Enterprise Edition versions 11.5.x through 11.5.7 Description The issue concerns...

PT-2019-18405

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 10.6 through 11.5.7 GitLab Enterprise Edition versions 11.6.0 through 11.6.5 GitLab Enterprise Edition versions 11.7.0 Description The issue concerns incorrect access control in the merge request approvers...

DEBIAN-CVE-2016-7398

A type confusion vulnerability in the mergeparam function of phphttpparams.c in PHP's pecl-http extension 3.1.0beta2 PHP 7 and earlier as well as 2.6.0beta2 PHP 5 and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests...

UBUNTU-CVE-2016-7398

A type confusion vulnerability in the mergeparam function of phphttpparams.c in PHP's pecl-http extension 3.1.0beta2 PHP 7 and earlier as well as 2.6.0beta2 PHP 5 and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests...

GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests

I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...

PT-2019-7841

Name of the Vulnerable Software and Affected Versions pecl-http extension versions 3.1.0beta2 and earlier PHP 7 pecl-http extension versions 2.6.0beta2 and earlier PHP 5 Description A type confusion issue in the merge param function of php http params.c allows attackers to crash PHP and possibly...

Unspecified Vulnerability in GitLab (CNVD-2019-30487)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

GitLab Restriction Bypass Vulnerability (CNVD-2019-31324)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

Unspecified Vulnerability in GitLab (CNVD-2019-30490)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

GitLab: Container scanning and Dependency scanning report leaked to unauthorized users

Hi GitLab Security team Summary GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab...

Microsoft Font Subsetting - DLL Heap Corruption in ReadAllocFormat12CharGlyphMapList

-----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the specific glyphs used in the document where the fonts are embedded. It is used by Windows G...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

GitLab: Head pipeline leaked to unauthorized users via blocking merge request feature

Summary GitLab allows for public and internal projects to restrict the visibility of pipelines to project members only. Then, only project members should have access to the pipeline information. GitLab recently added the blocking merge request feature. This feature can be used to leak the head...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

Prototype Pollution

Overview Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing property that will exist on all objects...

CVE-2019-1010304

CVE-2019-1010304 affects Saleor’s GraphQL API (ProductVariant in the GraphQL schema) where Incorrect Access Control allowed an unauthenticated user to access data via the publicly exposed /graphql/ endpoint. The issue enables exposure of potentially admin-restricted shop revenue data. Impact is d...

CVE-2019-1010304

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated...

Microsoft Font Subsetting - DLL Heap Corruption in ComputeFormat4CmapData

Microsoft Font Subsetting - DLL Heap Corruption in ComputeFormat4CmapData -----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the specific glyphs...