Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
673 results · page 13 of 14
Jun 8, 2021All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.1CVE-2021-22219 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.4
All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumptiCVE-2021-22217 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the viCVE-2021-22213 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.8
A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.CVE-2021-22218 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.6
All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting fromCVE-2021-22214 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2.CVE-2021-22210 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8.CVE-2021-22209 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.CVE-2021-22211 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all vCVE-2021-22203 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all previous versions.CVE-2021-22202 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.4
An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9.CVE-2021-22201 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6.CVE-2021-22200 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.9
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of publiCVE-2021-22198 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rigCVE-2021-22197 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4.CVE-2021-22196 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2021Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlCVE-2021-22177 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on thCVE-2021-22192 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.9
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group ownersCVE-2021-22186 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.9
An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2021Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that cCVE-2021-22189 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.9
Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership.CVE-2020-26417 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2.CVE-2020-26413 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker CVE-2020-26408 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user CVE-2020-13357 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassingCVE-2020-26409 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scrCVE-2020-26407 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
- Product
- Gitlab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the CVE-2020-13359 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.6
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9.CVE-2020-13356 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14.CVE-2020-13355 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations.CVE-2020-26405 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.1
Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on pCVE-2020-13351 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runnerCVE-2020-13350 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects.CVE-2020-13358 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.7
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.
- Product
- Gitlab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6.CVE-2020-13354 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group.CVE-2020-13352 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.CVE-2020-13300 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster tokenCVE-2020-13264 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source codeCVE-2020-13261 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1CVE-2020-13276 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.4
User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1CVE-2020-13273 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verificationCVE-2020-13265 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on beCVE-2020-13262 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5CVE-2020-13277 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.3
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13CVE-2020-13271 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted publCVE-2020-13270 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later throCVE-2020-13269 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1CVE-2020-13267 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys underCVE-2020-13266 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-5466 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Jan 27, 2020An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly creCVE-2019-5465 · Websites & servers · GitLab · reported by support@hackerone.comMedium 4.3
An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Jan 27, 2020A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utCVE-2019-5464 · Websites & servers · GitLab · reported by support@hackerone.comCritical 9.8
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgitlab.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.