PT-2019-20041

Name of the Vulnerable Software and Affected Versions lutils-merge versions all Description The issue concerns Prototype Pollution, where the merge function fails to prevent user input from altering an Object's prototype. This allows attackers to modify or override properties of all objects in th...

GHSA-GM9G-2G8V-FVXJ Prototype Pollution in upmerge

All versions of upmerge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

PT-2019-20047

Name of the Vulnerable Software and Affected Versions upmerge versions affected versions not specified Description The issue concerns a Prototype Pollution problem. The merge function fails to prevent user input from altering an Object's prototype, allowing attackers to modify or override...

Prototype Pollution

Overview All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with...

Authorization

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-7353

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

CVE-2019-7353

Removed by vendor...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-6790

Removed by vendor...

PT-2019-18349

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.14 through 11.5.8 GitLab Community and Enterprise Edition versions 11.6.x through 11.6.6 GitLab Community and Enterprise Edition versions 11.7.x through 11.7.1 Description An issue of incorrec...

CVE-2019-6790: Missing Authorization

An Incorrect Access Control issue 2 of 3 issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests...

CVE-2019-7353: Exposure of Sensitive Information to an Unauthorized Actor

An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects...

GitLab: Last pipeline status for MR leaked

Hi GitLab security team, Summary GitLab allows for public and internal projects to restrict the visibility of pipelines to project members only. Then, only project members should have access to the pipeline information. However, this can be bypassed. There is a internal endpoint...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated attacker could exploit a flaw in the Merge component to cause denial of service conditions...

Cross site scripting

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page...