CVE-2020-10076

GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests...

CVE-2020-10076

Removed by vendor...

CVE-2020-10076

Summary: CVE-2020-10076 affects GitLab 12.1–12.8.1 and is a stored cross-site scripting (XSS) vulnerability observed when rendering merge requests. The Red Hat, OSV, CNVD and other feeds corroborate this description, listing the same affected range and issue. What is affected: GitLab application ...

CVE-2020-10078

Removed by vendor...

CVE-2020-10078

GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability...

CVE-2020-10085

Removed by vendor...

CVE-2020-10085

GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles...

PT-2020-11903 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 12.8.1 Description: The issue is related to a stored cross-site scripting vulnerability in the merge request submission form. This allows for XSS attacks. Recommendations: For GitLab versions 12.1 through 12.8.1,...

PT-2020-11901 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 12.8.1 Description: A stored cross-site scripting issue was found when displaying merge requests, allowing for XSS attacks. Recommendations: For versions 12.1 through 12.8.1, update to a version that contains a fi...

PT-2020-11910 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.3.5 through 12.8.1 Description: The issue allows information disclosure. A particular view was exposing merge private merge request titles. Recommendations: For GitLab versions 12.3.5 through 12.8.1, update to a version tha...

CVE-2019-10808

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...

CVE-2019-10808

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype...

CVE-2019-10808

CVE-2019-10808 affects utilitify prior to 1.0.3. The merge function can facilitate prototype pollution by adding or modifying properties on Object.prototype, enabling attackers to tamper with object hierarchies. This is documented across multiple sources (GHSA/Snyk and vendor advisories). remedia...

CVE-2019-13011

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

CVE-2019-13011

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

Code injection

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

Improper access control

An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control...

CVE-2019-13011

Removed by vendor...

CVE-2019-13011

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity...

CVE-2019-13002

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control...