CVE-2020-13264: Exposure of Sensitive Information to an Unauthorized Actor

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token...

CVE-2020-13261: Exposure of Sensitive Information to an Unauthorized Actor

Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...

CVE-2020-13262: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...

CVE-2020-13273: Undefined Security Weakness

A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1...

CVE-2020-13265: Insufficient Verification of Data Authenticity

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...

CVE-2020-13276: Missing Authorization

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13277: Incorrect Authorization

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...

CVE-2020-13268

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

Design/Logic Flaw

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

CVE-2020-13269

CVE-2020-13269 : A Reflected Cross-Site Scripting vulnerability affects GitLab CE/EE in the Static Site Editor, with exploits possible on versions 12.10 through 13.0.1. The issue is caused by a reflected XSS flaw that enables execution of arbitrary JavaScript. Public details consistently describe...

CVE-2020-13269

Removed by vendor...

CVE-2020-13268

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

CVE-2020-13268

Removed by vendor...

CVE-2020-13267: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1...

CVE-2020-13268: Exposure of Sensitive Information to an Unauthorized Actor

A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1...

CVE-2020-13271: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13269: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1...

CVE-2020-13270: Missing Authorization

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

CVE-2020-13266

Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions...

CVE-2020-13266

CVE-2020-13266 affects GitLab CE/EE 12.8–13.0.1, with insecure authorization in Project Deploy Keys. The issue allows a user to update permissions on other users’ deploy keys under certain conditions. No exploitation details are provided in the supplied documents. Affected components: GitLab Depl...