CVE-2020-10081

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user...

CVE-2020-10081

GitLab before 12.8.2 has an Incorrect Access Control vulnerability where the LFS import process could allow a user to access LFS objects not owned by them. Affects GitLab self-hosted deployments prior to 12.8.2; root cause is access-control weakness in the LFS import path. CVSS (3.1) base score 6...

CVE-2020-10081

Removed by vendor...

PT-2020-11906 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.8.2 Description: The issue is related to incorrect access control in the LFS import process, potentially allowing access to LFS objects not owned by the user. This was internally discovered. Recommendations: For...

Security update for haproxy (important)

openSUSE Security Update: Security update for haproxy Announcement ID: openSUSE-SU-2019:2645-1 Rating: important References: 1082318 1154980 1157712 1157714 Cross-References: CVE-2019-18277 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has three fixes is now...

CVE-2019-6786

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 1 of 3. The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known...

CVE-2019-6786

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 1 of 3. The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known...

Improper access control

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 1 of 3. The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known...

CVE-2019-6786

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control issue 1 of 3. The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known...

CVE-2019-6786

CVE-2019-6786 affects GitLab Community and Enterprise Edition prior to 11.5.8, 11.6.x prior to 11.6.6, and 11.7.x prior to 11.7.1. The issue is an Incorrect Access Control where the contents of an LFS object can be accessed by an unauthorized user if the file size and OID are known. This results ...

Gitlab -- Arbitrary File read in GitLab project import with Git LFS

Gitlab reports: Arbitrary File read in GitLab project import with Git LFS...

lfs-hohenlehen.ac.at XSS vulnerability

Open Bug Bounty ID: OBB-710057 Description| Value ---|--- Affected Website:| lfs-hohenlehen.ac.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

lfs-tullnerbach.ac.at XSS vulnerability

Open Bug Bounty ID: OBB-710055 Description| Value ---|--- Affected Website:| lfs-tullnerbach.ac.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

lfs-edelhof.ac.at XSS vulnerability

Open Bug Bounty ID: OBB-613184 Description| Value ---|--- Affected Website:| lfs-edelhof.ac.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lfs-warth.ac.at XSS vulnerability

Open Bug Bounty ID: OBB-613182 Description| Value ---|--- Affected Website:| lfs-warth.ac.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lfs-tulln.ac.at XSS vulnerability

Open Bug Bounty ID: OBB-606902 Description| Value ---|--- Affected Website:| lfs-tulln.ac.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Remote Command Execution (RCE)

github.com/git-lfs/git-lfs is vulnerable to remote code execution RCE attacks. The application does not sanitize ssh:// URLs passed to it, allowing a malicious user to execute arbitrary commands...

GitHub Git LFS Arbitrary Command Execution Vulnerability

GitHub Git LFS is a U.S. GitHub company developed an open source project . GitHub Git LFS for version control of large files in the open source Git extension . An arbitrary command execution vulnerability exists in GitHub Git LFS versions prior to 2.1.1. The vulnerability can be exploited by remo...

CVE-2017-17831

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...

Arbitrary file deletion

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository...