CVE-2020-7966: Improper Limitation of a Pathname to a Restricted Directory

GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal...

CVE-2020-7971: Improper Neutralization of Input During Web Page Generation

GitLab EE 11.0 and later through 12.7.2 allows XSS...

CVE-2020-7968: Missing Authorization

GitLab EE 8.0 through 12.7.2 has Incorrect Access Control...

CVE-2020-7967: Incorrect Default Permissions

GitLab EE 8.0 through 12.7.2 has Insecure Permissions issue 1 of 2...

CVE-2020-7972: Incorrect Default Permissions

GitLab EE 12.2 has Insecure Permissions issue 2 of 2...

CVE-2020-7969: Undefined Security Weakness

GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure...

CVE-2020-7977: Incorrect Default Permissions

GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions...

CVE-2020-7978: Undefined Security Weakness

GitLab EE 12.6 and later through 12.7.2 allows Denial of Service...

CVE-2020-7974: Undefined Security Weakness

GitLab EE 10.1 through 12.7.2 allows Information Disclosure...

CVE-2020-7976: Undefined Security Weakness

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control...

CVE-2020-7979: Incorrect Default Permissions

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

CVE-2020-8114: Incorrect Default Permissions

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...

CVE-2019-15583

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE. When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API...

CVE-2019-5474

CVE-2019-5474 concerns GitLab EE: an authorization flaw in versions earlier than 12.1.2, 12.0.4, and 11.11.6 allows merge request approval rules to be overridden without proper permissions. The connected records consistently describe the issue as an authorization problem affecting the merge reque...

CVE-2019-5474

Removed by vendor...

PT-2020-11140

Name of the Vulnerable Software and Affected Versions GitLab EE versions prior to 12.1.2 GitLab EE versions prior to 12.0.4 GitLab EE versions prior to 11.11.6 Description An authorization issue was discovered allowing the merge request approval rules to be overridden without appropriate...

CVE-2019-5474: Improper Access Control

An authorization issue was discovered in GitLab EE 12.1.2, 12.0.4, and 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions...

PT-2020-9718

Name of the Vulnerable Software and Affected Versions GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.3.2 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.2.6 GitLab Community Edition CE and Enterprise Edition EE versions prior to 12.1.12...

CVE-2020-5197

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...

CVE-2019-19312

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...