CVE-2020-13263

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...

Design/Logic Flaw

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

Code injection

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link...

CVE-2020-13261

CVE-2020-13261 affects GitLab CE/EE 12.6 through 13.0.1, where Amazon EKS credentials can be disclosed to other administrators via HTML source code. Connected sources confirm the vulnerability and affected ranges, but do not provide concrete exploit steps or a published remediation version. The i...

CVE-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13277

The CVE-2020-13277 issue is a real authorization flaw in GitLab’s repository mirroring logic that allowed read access to private repositories in CE/EE. Affected versions span GitLab CE/EE 10.6 through 13.0.5. Remediation per connected details: upgrade to GitLab fixes for the applicable lines (e.g...

CVE-2020-13263: Incorrect Authorization

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...

CVE-2020-13275: Undefined Security Weakness

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13269

CVE-2020-13269 : A Reflected Cross-Site Scripting vulnerability affects GitLab CE/EE in the Static Site Editor, with exploits possible on versions 12.10 through 13.0.1. The issue is caused by a reflected XSS flaw that enables execution of arbitrary JavaScript. Public details consistently describe...

CVE-2020-13266

CVE-2020-13266 affects GitLab CE/EE 12.8–13.0.1, with insecure authorization in Project Deploy Keys. The issue allows a user to update permissions on other users’ deploy keys under certain conditions. No exploitation details are provided in the supplied documents. Affected components: GitLab Depl...

CVE-2020-12448

GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet...

CVE-2020-12448: Improper Limitation of a Pathname to a Restricted Directory

GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet...

CVE-2020-11649

An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...

CVE-2020-11649: Missing Authentication for Critical Function

An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10981: Undefined Security Weakness

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

CVE-2020-10976: Exposure of Sensitive Information to an Unauthorized Actor

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

CVE-2020-10979: Undefined Security Weakness

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

CVE-2020-10975: Undefined Security Weakness

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...