Filtered by vendor Gitlab
Subscriptions
Total
981 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-15730 | 1 Gitlab | 1 Gitlab | 2019-09-18 | 7.5 High |
| An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server. | ||||
| CVE-2019-15734 | 1 Gitlab | 1 Gitlab | 2019-09-18 | 4.3 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these. | ||||
| CVE-2019-15721 | 1 Gitlab | 1 Gitlab | 2019-09-17 | 5.4 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings. | ||||
| CVE-2019-15738 | 1 Gitlab | 1 Gitlab | 2019-09-17 | 5.3 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email. | ||||
| CVE-2019-15740 | 1 Gitlab | 1 Gitlab | 2019-09-17 | 5.3 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads. | ||||
| CVE-2019-15739 | 1 Gitlab | 1 Gitlab | 2019-09-17 | 6.1 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads. | ||||
| CVE-2019-11545 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 4.3 Medium |
| An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue. | ||||
| CVE-2019-11546 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 5.3 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge. | ||||
| CVE-2019-11548 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 5.4 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint. | ||||
| CVE-2019-6793 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 7.0 High |
| An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue. | ||||
| CVE-2019-6783 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 8.8 High |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution. | ||||
| CVE-2019-6784 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 6.1 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS. | ||||
| CVE-2019-11605 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 7.5 High |
| An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token. | ||||
| CVE-2019-6995 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 6.5 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues. | ||||
| CVE-2019-6791 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 6.5 Medium |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility. | ||||
| CVE-2018-19856 | 1 Gitlab | 1 Gitlab | 2019-09-09 | N/A |
| GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API. | ||||
| CVE-2019-6796 | 1 Gitlab | 1 Gitlab | 2019-09-09 | N/A |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS. | ||||
| CVE-2019-9866 | 1 Gitlab | 1 Gitlab | 2019-09-09 | N/A |
| An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure. | ||||
| CVE-2019-14943 | 1 Gitlab | 1 Gitlab | 2019-09-04 | N/A |
| An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. | ||||
| CVE-2018-19576 | 1 Gitlab | 1 Gitlab | 2019-07-11 | N/A |
| GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential. | ||||