1630 matches found
Remote code execution
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19312
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...
CVE-2019-19628
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19314
GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext...
CVE-2019-19313
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...
CVE-2019-19312
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...
PT-2020-10133
Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.3 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits. Recommendations Fo...
PT-2020-10134
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.4 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns the storage of several tokens in plaintext. Recommendations For GitLab EE versions 8.4 through 12.5, update to a version that...
PT-2020-10203
Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue is related to insufficient parameter sanitization for the Maven package registry, which could lead to privilege escalation and remot...
PT-2020-10204
Name of the Vulnerable Software and Affected Versions GitLab EE versions 10.5 through 12.5.3 GitLab EE version 12.4.5 GitLab EE version 12.3.8 Description The issue allows private code to be disclosed via the Group Search API provided by the Elasticsearch integration when transferring a public...
PT-2020-10132
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue concerns incorrect access control. After a project is changed to private, previously forked repositories can still access information...
CVE-2019-19629: Undefined Security Weakness
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration...
CVE-2019-19628: Improper Limitation of a Pathname to a Restricted Directory
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions...
CVE-2019-19314: Cleartext Storage of Sensitive Information
GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext...
CVE-2019-19313: Improper Handling of Exceptional Conditions
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits...
CVE-2019-19312: Undefined Security Weakness
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API...
CVE-2019-19256
Removed by vendor...
CVE-2019-19311
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields...
PT-2020-10131
Name of the Vulnerable Software and Affected Versions GitLab EE versions 8.14 through 12.5 GitLab EE version 12.4.3 GitLab EE version 12.3.6 Description The issue allows for XSS in group and profile fields. Recommendations For GitLab EE versions 8.14 through 12.5, update to a version outside of...