1448 matches found
CVE-2020-10953: Improper Limitation of a Pathname to a Restricted Directory
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue...
CVE-2020-10955: Missing Authorization
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...
CVE-2020-10073
CVE-2020-10073 affects GitLab EE versions 12.4.2–12.8.1. A DoS could be triggered by a flaw in permissions checks that may impact a project homepage. Exploitation details are not provided in the documents; no in‑the‑wild exploit info is referenced. Remediation is to upgrade to a fixed release (e....
CVE-2020-10084: Undefined Security Weakness
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerabilityfeedback endpoint could result in the exposure of a private project namespace...
CVE-2020-10077: Server-Side Request Forgery (SSRF)
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk...
CVE-2020-10073: Undefined Security Weakness
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page...
CVE-2019-13121
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control...
U.S. Dept Of Defense: Admin Login Credential Leak for DoD Gitlab EE instance
Summary A DoD employee/contractor exposed the ███ password in a GitHub repository █████████ leading to full ███ access in a DoD DISA-associated private Gitlab EE instance ███. Description The IP address ████ recently hosted the subdomain █████████ as of 2019-09-23. ██████ Now port 80 points to a...
CVE-2020-8795
In GitLab Enterprise Edition EE 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-6833
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling...
CVE-2020-7974
GitLab EE 10.1 through 12.7.2 allows Information Disclosure...
CVE-2020-7969
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure...
CVE-2020-7969
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure...
CVE-2020-7967
GitLab EE 8.0 through 12.7.2 has Insecure Permissions issue 1 of 2...
CVE-2020-7972
GitLab EE 12.2 has Insecure Permissions issue 2 of 2...
