CVE-2020-13266

Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...

CVE-2020-13266: Missing Authorization

Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...

CVE-2020-6937: Undefined Security Weakness

A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion...

PT-2020-19298

Name of the Vulnerable Software and Affected Versions MuleSoft Mule CE/EE versions 3.8.x through 4.x released before April 7, 2020 Description A Denial of Service issue could allow remote attackers to submit data which can lead to resource exhaustion. Recommendations For versions 3.8.x, 3.9.x, an...

CVE-2019-12428

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...

CVE-2019-15586

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2019-15586

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2019-15578

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

CVE-2019-5466

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-15586

Removed by vendor...

CVE-2019-15586: Improper Neutralization of Input During Web Page Generation

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

PT-2020-9720

Name of the Vulnerable Software and Affected Versions Gitlab CE/EE versions prior to 12.1.10 Description A cross-site scripting XSS issue exists in the Mermaid plugin. Recommendations For versions prior to 12.1.10, update to version 12.1.10 or later to resolve the issue...

PT-2020-11134

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.2 and later Description A flawed DNS rebinding protection issue was discovered in the url blocker.rb library, which could result in Server-Side Request Forgery SSRF where the library is utilized. Recommendations For...

PT-2020-11135

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.14 and later Description An information disclosure issue was discovered, which could result in the disclosure of the newly created issue ID when using the move issue feature. Recommendations For GitLab CE/EE versions 8....

PT-2020-11136

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.5 and later Description A security issue was found that allows the disclosure of label names through the new merge requests endpoint. Recommendations For GitLab CE/EE versions 11.5 and later, consider restricting acces...

CVE-2019-5465: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID...

PT-2020-11133

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.0 and later Description A privilege escalation issue was discovered when trigger tokens are not rotated once ownership of them has changed. Recommendations For GitLab CE/EE versions 9.0 and later, rotate trigger tokens...

CVE-2019-5464: Improper Input Validation

A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the urlblocker.rb which could result in SSRF where the library is utilized...

CVE-2019-5462: Insufficient Session Expiration

A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...

CVE-2019-5466: Authorization Bypass Through User-Controlled Key

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...