CVE-2018-19582: Authorization Bypass Through User-Controlled Key

GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user...

CVE-2018-19583: Insertion of Sensitive Information into Log File

GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token...

CVE-2018-19570: Improper Neutralization of Input During Web Page Generation

GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags...

CVE-2018-19573: Improper Neutralization of Input During Web Page Generation

GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid...

Qualys Cloud Platform (VM, PC) 8.20 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...

rehvid123.ee Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-869385 Security Researcher metamorfosec Helped patch 1957 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting rehvid123.ee website a...

CVE-2018-19585

CVE-2018-19585 covers CRLF Injection in GitLab CE/EE Project Mirroring when using the Git protocol. Affected: GitLab versions 8.18–11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The root cause is CRLF injection in mirroring requests; public material references exploitation o...

CVE-2018-19585: Improper Neutralization of CRLF Sequences

GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol...

Authorization Bypass

wildfly-ee is vulnerable to authorization bypass. The vulnerability exists as an incorrect SecurityIdentity for wildfly-ee concurrency could be used when a ElytronManagedThread that uses a different SecurityIdentity does not terminate from its previous thread and executes a new job...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-18643

CVE-2018-18643 affects GitLab CE & EE versions 11.2 and later, up to but not including 11.5.0-rc12, and includes 11.4.6 and 11.3.10. The vulnerability is a Persistent XSS issue described in the CVE entry. The provided connected documents confirm the existence of a persistent cross‑site scripting ...

CVE-2018-18643: Improper Neutralization of Input During Web Page Generation

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...

CVE-2018-19856

GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API...

CVE-2018-19856

GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API...

Directory traversal

GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API...

CVE-2018-19856

GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API...

CVE-2018-19856

Removed by vendor...

CVE-2018-19856

CVE-2018-19856 affects GitLab CE/EE with directory traversal in the Templates API. Affected versions: GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3. Root cause is a directory traversal vulnerability in the Templates API that could expose sensitive data. CVSS metrics...