Information disclosure

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...

CVE-2019-6788

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...

UBUNTU-CVE-2019-6788

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 3 of 6. For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the us...

CVE-2019-6788

CVE-2019-6788 affects GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The issue enables an information disclosure via a covert redirect when using GitHub or Bitbucket OAuth integrations, allowing retrieval of a user OAuth token for those serv...

CVE-2019-6788

Removed by vendor...

Argument Injection - CVE-2019-15000

Bitbucket Server & Bitbucket Data Center had an argument injection vulnerability, allowing an attacker to inject additional arguments into Git commands, which could lead to remote code execution. Remote attackers can exploit this argument injection vulnerability if they are able to access a Git...

Argument Injection - CVE-2019-15000

Bitbucket Server & Bitbucket Data Center had an argument injection vulnerability, allowing an attacker to inject additional arguments into Git commands, which could lead to remote code execution. Remote attackers can exploit this argument injection vulnerability if they are able to access a Git...

Bitbucket 6.1.1 Path Traversal to RCE

Impact In Bitbucket the four different user roles Bitbucket User, Project Creator, Admin and System Admin exist. An attacker with the permissions of the role Admin can abuse Bitbuckets Data Center Migration tool to drop an executable shell script in an arbitrary directory. This is caused by a...

CloudBees Jenkins Bitbucket Approve Plugin Trust Management Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Bitbucket Approve Plugin is used in one of the plugin used to support uploading...

Atlassian Bitbucket Data Center 5.13.x < 5.13.6 / 5.14.x < 5.14.4 / 5.15.x < 5.15.3 / 5.16.x < 5.16.3 / 6.0.x < 6.0.3 / 6.1.x < 6.1.2 Path Traversal Vulnerability (SA-2019-05-22)

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

Bitbucket sends email notifications to unlicensed users for pushed commits in a repository

h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...

Bitbucket sends email notifications to unlicensed users for pushed commits in a repository

h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...

GHSA-VG35-VC9F-Q7X2 Improper Restriction of XML External Entity Reference in ladon

Ladon since 0.6.1 since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059 is affected by: XML External Entity XXE. The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance:...

Improper Restriction of XML External Entity Reference in ladon

Ladon since 0.6.1 since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059 is affected by: XML External Entity XXE. The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance:...

Pushing a code with an unlicensed user is possible if it was once a licensed user and an SSH key is added to user's profile

h3. Issue Summary If once licensed users have an SSH key added to their profile, it is still possible for them to push the code once the license had been removed. However, it is not possible to pull the code. h3. Environment Every environment. h3. Steps to Reproduce Create a new user. Add any...

Pushing a code with an unlicensed user is possible if it was once a licensed user and an SSH key is added to user's profile

h3. Issue Summary If once licensed users have an SSH key added to their profile, it is still possible for them to push the code once the license had been removed. However, it is not possible to pull the code. h3. Environment Every environment. h3. Steps to Reproduce Create a new user. Add any...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

Path traversal

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...