CVE-2020-28002

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint...

Authentication flaw

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint...

IDOR Disclosure of Private Project Titles - CVE-2020-14174

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References IDOR vulnerability in the Administration Permission Helper. Affected versions: version 7.13.16 8.0.0 ≤ version 8.5.7 8.6.0 ≤ version 8.9.2...

GitLab Information Disclosure Vulnerability (CNVD-2020-19019)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

CVE-2019-12434

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...

CVE-2019-12434

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...

Information disclosure

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...

CVE-2019-12434

CVE-2019-12434 affects GitLab Community and Enterprise Edition 10.6–11.11. An information-disclosure flaw allows an attacker to guess private project URL slugs by comparing destination URLs of issues linked in comments. The root cause is exposure through comment-linked issue destinations, enablin...

CVE-2019-12434

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure...

CVE-2019-12434

Removed by vendor...

GitLab Access Control Error Vulnerability (CNVD-2020-16706)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An access...

UBUNTU-CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

PT-2020-9722 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2.2 and earlier Description: The issue allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. Recommendations: For GitLab versions 12.2.2 and earlier, update t...

CVE-2019-15579

An information disclosure exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE where the assignees of a confidential issue in a private project would be disclosed to a guest via milestones...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

Design/Logic Flaw

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

CVE-2020-6832

Removed by vendor...

CVE-2020-6832

An issue was discovered in GitLab Enterprise Edition EE 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects...

GitLab: Elasticsearch leaks data through the notes scope

Summary The Elasticsearch results, when filtering using the notes scope, leaks data about private groups, private projects, and private issues. Steps to reproduce 1. Search, as an anonymous user, nextbit in the Gitlab group, filtering for "comments" link 2. You will have as result a private note...