CVE-2019-5466

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...

CVE-2019-15578

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests...

CVE-2019-15586

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2019-5466

Technical details about CVE-2019-5466 are not publicly provided in the connected documents. Monitor for updates from vendors (GitLab, Red Hat, Ubuntu, Debian, CVE List) for affected versions, impact, and remediation.

CVE-2019-15582

An IDOR was discovered in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE that allowed a maintainer to add any private group to a protected environment...

CVE-2019-5474

CVE-2019-5474 concerns GitLab EE: an authorization flaw in versions earlier than 12.1.2, 12.0.4, and 11.11.6 allows merge request approval rules to be overridden without proper permissions. The connected records consistently describe the issue as an authorization problem affecting the merge reque...

CVE-2019-5474

Removed by vendor...

CVE-2019-5465

CVE-2019-5465 affects GitLab CE/EE 8.14 and later. The issue is an information disclosure in the move issue feature that could disclose the newly created issue ID. The Connected documents confirm the vulnerability description across multiple sources, but do not provide concrete remediation detail...

CVE-2019-15583

CVE-2019-15583 affects GitLab Community Edition (CE) and Enterprise Edition (EE) through versions earlier than 12.3.2, 12.2.6, and 12.1.12, where moving an issue from a private project to a public project discloses private labels and the private project namespace via the GitLab API. The underlyin...

CVE-2019-5464

CVE-2019-5464 affects GitLab CE/EE 10.2 and later due to a flawed DNS rebinding protection in lib/gitlab/url_blocker.rb, which can result in SSRF when the library is used. The issue can allow an attacker to trigger requests to the local/internal network (e.g., via webhooks), with high impact (net...

CVE-2019-15586

Removed by vendor...

CVE-2019-15586

CVE-2019-15586 is a cross-site scripting vulnerability in the GitLab Mermaid plugin for GitLab CE/EE, affecting versions prior to 12.1.10. The root cause is insufficient validation of client-side data, enabling an attacker to execute arbitrary client-side scripts within affected instances. Practi...

Improper access control

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

CVE-2019-20142

CVE-2019-20142 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 12.3–12.6.1, allowing a Denial of Service . The Red Hat, NVD, OSV, and CVE records corroborate the DoS impact for GitLab CE/EE 12.3–12.6.1. The issued remediation in the public references indicates a patch r...

CVE-2019-20143

Affected product: GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. The issue is described as an Incorrect Access Control vulnerability. The connected Red Hat and OSV notes corroborate the same description; no further root-cause details are provided in the excerpts. The NVD entry li...

CVE-2019-20144

GitLab CVE-2019-20144 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 10.8 through 12.6.1, with a root cause described as Incorrect Access Control. The NVD CVSS entries indicate a Network attack vector, Low complexity, and Privileges Required: Low, yielding a medium sev...

CVE-2019-20146

Removed by vendor...

CVE-2019-20148

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

CVE-2020-5197

CVE-2020-5197 affects GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1–12.6.1 and is described as an Incorrect Access Control flaw. Connected sources confirm the affected software range and the nature of the issue; no exploit details are provided in the documents. A security release ...

CVE-2019-19628

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...