CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

Remote code execution

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19629

CVE-2019-19629 affects GitLab Enterprise Edition (EE) versions 10.5 through 12.5.3, 12.4.5, and 12.3.8. The issue arises during transfer of a public project to a private group, where private code could be disclosed through the Group Search API provided by the Elasticsearch integration. Multiple s...

CVE-2019-19313

CVE-2019-19313 affects GitLab Enterprise Edition: vulnerable versions include 12.3 through 12.5, 12.4.3, and 12.3.6. The issue leads to a Denial of Service: it can render issues and commits uncreatable, uneditable, or viewable due to specific characters. Impact is described as DoS with availabili...

CVE-2019-19313

Removed by vendor...

CVE-2019-19312

GitLab EE 8.14–12.5, 12.4.3, and 12.3.6 suffer from Incorrect Access Control: after a project is made private, forked repositories could still query the API to obtain information about the private project. Impact is information disclosure via the API; no exploit details are provided beyond this. ...

Improper access control

GitLab Community Edition CE and Enterprise Edition EE through 12.5 has Incorrect Access Control issue 2 of 2...

CVE-2019-19310

CVE-2019-19310 affects GitLab Enterprise Edition (EE) versions 9.0 through 12.5, allowing information disclosure. The connected Red Hat, NVD, Debian, and other feeds corroborate that EE 9.0+ through 12.5 is vulnerable to information leakage; no explicit root cause, affected file/component, or exp...

CVE-2019-19309

GitLab CVE-2019-19309 affects GitLab Enterprise Edition (EE) 8.90 and later through 12.5, described as an Incorrect Access Control issue. Connected sources confirm the affected product scope and that remediation was addressed in GitLab’s releases around 12.5 (e.g., security release 12-5-1). The C...

CVE-2019-19262

GitLab Enterprise Edition (EE) versions 11.9 through 12.5 have an insecure-permissions vulnerability (CVE-2019-19262). The issue concerns improper permissions on components that could enable partial disclosure of sensitive data, notably Grafana metrics, as documented in multiple sources. Affected...

CVE-2019-19260

Technical details about CVE-2019-19260 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories for affected products and fixes.

CVE-2019-19258

CVE-2019-19258 affects GitLab Enterprise Edition (EE) 10.8 and later through 12.5, described as Incorrect Access Control. Connected documents confirm the affected product/version and nature of the flaw but do not provide technical specifics (root cause, affected components, or fix). No explicit e...

CVE-2019-19256

Removed by vendor...

CVE-2019-19311

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...

CVE-2019-19254

CVE-2019-19254 affects GitLab Community Edition (CE) and Enterprise Edition (EE) from 9.6 up to 12.5, described as an Incorrect Access Control issue. The connected sources confirm the impacted versions and indicate a security release for GitLab 12.5.x (12.5.1) addressing the vulnerability; no exp...

CVE-2019-15576

An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...

CVE-2019-15575

A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...

CVE-2019-15577

An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed project milestones to be disclosed via groups browsing...

CVE-2019-5487

An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...