4832 matches found
CVE-2019-19262: Incorrect Permission Assignment for Critical Resource
GitLab Enterprise Edition EE 11.9 and later through 12.5 has Insecure Permissions...
CVE-2019-19311: Improper Neutralization of Input During Web Page Generation
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
PT-2020-10111
Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions 11.3 through 12.5 Description The issue is related to an Insecure Direct Object Reference IDOR. No information is provided about the estimated number of potentially affected devices worldwide or real-world...
PT-2020-10110
Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions 10.8 through 12.5 Description The issue concerns incorrect access control. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world...
PT-2020-10107
Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition EE versions 12.3 through 12.5 Description The issue is related to incorrect access control. Recommendations For GitLab Enterprise Edition EE versions 12.3 through 12.5, update to a version that contains a fix for this...
CVE-2019-15577
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed project milestones to be disclosed via groups browsing...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-15575
A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...
CVE-2019-15576
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...
CVE-2019-5487
An improper access control vulnerability exists in Gitlab EE v12.3.3, v12.2.7, & v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits...
CVE-2019-15577
CVE-2019-15577 affects GitLab CE/EE < v12.3.2, < v12.2.6,
CVE-2019-15577
Removed by vendor...
PT-2019-14293
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows project milestones to be disclosed via groups browsing...
PT-2019-14292
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows an attacker to view private system notes from a GraphQL endpoint...
PT-2019-17704
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description A authentication bypass vulnerability exists in the Salesforce login integration that could be used by an attacker t...
PT-2019-14291
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description A command injection issue exists that allows an attacker to inject commands via the API through the blobs scope...
PT-2019-17705
Name of the Vulnerable Software and Affected Versions Gitlab EE versions prior to 12.3.3 Gitlab EE versions prior to 12.2.7 Gitlab EE versions prior to 12.1.13 Description An issue exists that allows the group search feature with Elasticsearch to return private code, merge requests, and commits d...
CVE-2019-15575: Improper Neutralization of Special Elements used in a Command
A command injection exists in GitLab CE/EE...