2114 matches found
CVE-2019-5466: Authorization Bypass Through User-Controlled Key
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names...
CVE-2019-15586: Improper Neutralization of Input During Web Page Generation
A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...
PT-2020-11136
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.5 and later Description A security issue was found that allows the disclosure of label names through the new merge requests endpoint. Recommendations For GitLab CE/EE versions 11.5 and later, consider restricting acces...
PT-2020-9718
Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...
PT-2020-11133
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.0 and later Description A privilege escalation issue was discovered when trigger tokens are not rotated once ownership of them has changed. Recommendations For GitLab CE/EE versions 9.0 and later, rotate trigger tokens...
CVE-2019-5462: Insufficient Session Expiration
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed...
CVE-2019-5464: Improper Input Validation
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the urlblocker.rb which could result in SSRF where the library is utilized...
CVE-2020-5197
An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...
CVE-2019-20146
Removed by vendor...
CVE-2019-15577
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed project milestones to be disclosed via groups browsing...
CVE-2019-15575
A command injection exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope...
CVE-2019-15576
An information disclosure vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint...
CVE-2019-5486
Removed by vendor...
CVE-2019-15576: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in GitLab CE/EE...
CVE-2019-15577: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in GitLab CE/EE...
CVE-2019-15575: Improper Neutralization of Special Elements used in a Command
A command injection exists in GitLab CE/EE...
PT-2019-14292
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows an attacker to view private system notes from a GraphQL endpoint...
PT-2019-14293
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description An information disclosure issue exists that allows project milestones to be disclosed via groups browsing...
PT-2019-14291
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 12.3.2 GitLab CE/EE versions prior to 12.2.6 GitLab CE/EE versions prior to 12.1.12 Description A command injection issue exists that allows an attacker to inject commands via the API through the blobs scope...