CVE-2017-12426

GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import...

CVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix...

GitLab: Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3)

Dear GitLab bug bounty team, Summary --- Gitlab.com is vulnerable to reverse tabnabbing in AsciiDoc files. Why does this vulnerability exist? --- In AsciiDoc the following http://example.comReverse Tabnabbing^ is equivalent to Reverse Tabnabbing. How can this exploited? --- Same scenario as...

CVE-2016-4340

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors...

Gitlab-shell Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 'Gitlab-shell Code Execution', 'Description' = %q This module takes advantage of the addition of authorized ssh keys...

CVE-2013-7316

Cross-site scripting XSS vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html...