CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

Code injection

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

UBUNTU-CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

CVE-2021-22223

GitLab CE/EE vulnerable to Client-Side code injection via feature flag names (CVE-2021-22223). Affected versions: 11.9 up to before 14.0.2. Root cause: crafted feature flag name allows PUT requests on behalf of other users when a link is clicked. Impact: an attacker could perform actions on behal...

CVE-2021-22223

Removed by vendor...

CVE-2021-22223

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link...

PT-2021-6758 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.9 and later Description: The issue is related to client-side code injection through a specially crafted Feature Flag name in GitLab, allowing an attacker to send PUT requests on behalf of other users via a link. This ...

SUSE: Security Advisory (SUSE-SU-2018:1378-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2020-13357

An issue was discovered in Gitlab CE/EE versions = 13.1 to = 13.5 to = 13.6 to 13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project...

CVE-2020-13357

An issue was discovered in Gitlab CE/EE versions = 13.1 to = 13.5 to = 13.6 to 13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project...

CVE-2020-13357

An issue was discovered in Gitlab CE/EE versions = 13.1 to = 13.5 to = 13.6 to 13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project...

PT-2020-13498 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.1 through 13.4.6 Gitlab CE/EE versions 13.5 through 13.5.4 Gitlab CE/EE versions 13.6 through 13.6.1 Description: An issue in Gitlab CE/EE allows an unauthorized user to access the user list corresponding to a feature...

Unauthorized Access

gitlab allows unauthorized access. An unauthorized user is able to access the user list corresponding to a feature flag in a project...

FreeBSD : Gitlab -- Multiple vulnerabilities (5d5e5cda-38e6-11eb-bbbf-001b217b3468)

Gitlab reports : XSS in Zoom Meeting URL Limited Information Disclosure in Private Profile User email exposed via GraphQL endpoint Group and project membership potentially exposed via GraphQL Search terms logged in search parameter in rails logs Un-authorised access to feature flag user list A...

Gitlab -- Multiple vulnerabilities

Gitlab reports: XSS in Zoom Meeting URL Limited Information Disclosure in Private Profile User email exposed via GraphQL endpoint Group and project membership potentially exposed via GraphQL Search terms logged in search parameter in rails logs Un-authorised access to feature flag user list A...

Information disclosure in Login - CVE-2020-4028

Users without session information should be pushed to the login page. Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in Login. Affected versions: version...

Bitbucket Data Center - Path traversal in the migration tool leads to RCE - CVE-2019-3397

h3. Issue Summary Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code executio...

Bitbucket Data Center - Path traversal in the migration tool leads to RCE - CVE-2019-3397

h3. Issue Summary Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code executio...