Filtered by vendor Gitlab
Subscriptions
Total
1068 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-6783 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 8.8 High |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution. | ||||
| CVE-2019-6240 | 1 Gitlab | 1 Gitlab | 2024-08-04 | N/A |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. | ||||
| CVE-2019-5883 | 1 Gitlab | 1 Gitlab | 2024-08-04 | N/A |
| An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to. | ||||
| CVE-2019-5468 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 8.8 High |
| An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account. | ||||
| CVE-2019-5466 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 4.3 Medium |
| An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. | ||||
| CVE-2019-5470 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 7.5 High |
| An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information. | ||||
| CVE-2019-5487 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 5.3 Medium |
| An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits. | ||||
| CVE-2019-5472 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 7.5 High |
| An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. | ||||
| CVE-2019-5465 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 4.3 Medium |
| An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID. | ||||
| CVE-2019-5467 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 5.4 Medium |
| An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. | ||||
| CVE-2019-5463 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 5.3 Medium |
| An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. | ||||
| CVE-2019-5474 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 6.5 Medium |
| An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions. | ||||
| CVE-2019-5461 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 3.5 Low |
| An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. | ||||
| CVE-2019-5462 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 8.8 High |
| A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. | ||||
| CVE-2019-5471 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 5.4 Medium |
| An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6. | ||||
| CVE-2019-5486 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 8.8 High |
| A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements. | ||||
| CVE-2019-5473 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 7.2 High |
| An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. | ||||
| CVE-2019-5469 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 6.5 Medium |
| An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets. | ||||
| CVE-2019-5464 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 9.8 Critical |
| A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized. | ||||
| CVE-2020-26415 | 1 Gitlab | 1 Gitlab | 2024-08-04 | 4.3 Medium |
| Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2. | ||||