CVE-2019-20144

GitLab CVE-2019-20144 affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 10.8 through 12.6.1, with a root cause described as Incorrect Access Control. The NVD CVSS entries indicate a Network attack vector, Low complexity, and Privileges Required: Low, yielding a medium sev...

CVE-2019-20146

Removed by vendor...

CVE-2019-20148

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 8.13 through 12.6.1. It has Incorrect Access Control...

CVE-2020-5197

CVE-2020-5197 affects GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1–12.6.1 and is described as an Incorrect Access Control flaw. Connected sources confirm the affected software range and the nature of the issue; no exploit details are provided in the documents. A security release ...

CVE-2019-19628

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

Remote code execution

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19629

CVE-2019-19629 affects GitLab Enterprise Edition (EE) versions 10.5 through 12.5.3, 12.4.5, and 12.3.8. The issue arises during transfer of a public project to a private group, where private code could be disclosed through the Group Search API provided by the Elasticsearch integration. Multiple s...

CVE-2019-19628

In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...

CVE-2019-19314

GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext...

CVE-2019-19313

CVE-2019-19313 affects GitLab Enterprise Edition: vulnerable versions include 12.3 through 12.5, 12.4.3, and 12.3.6. The issue leads to a Denial of Service: it can render issues and commits uncreatable, uneditable, or viewable due to specific characters. Impact is described as DoS with availabili...

CVE-2019-19313

GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...

CVE-2019-19313

Removed by vendor...

CVE-2019-19312

GitLab EE 8.14–12.5, 12.4.3, and 12.3.6 suffer from Incorrect Access Control: after a project is made private, forked repositories could still query the API to obtain information about the private project. Impact is information disclosure via the API; no exploit details are provided beyond this. ...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

CVE-2019-19312: Undefined Security Weakness

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...

PT-2020-10133

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits. Recommendations Fo...

PT-2020-10134

Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.4 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns the storage of several tokens in plaintext. Recommendations For GitLab EE versions 8.4 through 12.5, update to a version that...

PT-2020-10203

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue is related to insufficient parameter sanitization for the Maven package registry, which could lead to privilege escalation and remot...