Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

292 results · page 6 of 6

Apr 8, 2020GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.CVE-2020-10981 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.CVE-2020-10980 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.CVE-2020-10979 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.CVE-2020-10978 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.CVE-2020-10977 · Websites & servers · Gitlab · reported by MITREMedium 5.5
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.CVE-2020-10976 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.CVE-2020-10975 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specifCVE-2020-10955 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.CVE-2020-10953 · Websites & servers · Gitlab · reported by MITREHigh 7.5
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.CVE-2020-10952 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 3.0 through 12.8.1 allows SSRF.CVE-2020-10077 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 12.4.2 through 12.8.1 allows Denial of Service.CVE-2020-10073 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 11.6 through 12.8.1 allows Information Disclosure.CVE-2020-10084 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020An issue was discovered in GitLab EE 11.3 and later.CVE-2020-6833 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.CVE-2020-7978 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.CVE-2020-7977 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.CVE-2020-7976 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 10.1 through 12.7.2 allows Information Disclosure.CVE-2020-7974 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).CVE-2020-7972 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 11.0 and later through 12.7.2 allows XSS.CVE-2020-7971 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab EE 11.0 and later through 12.7.2 allows XSS.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.CVE-2020-7969 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.CVE-2020-7968 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-7967 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-7966 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.9 and later through 12.7.2 has Insecure PermissionCVE-2020-8114 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.9 and later through 12.7.2 has Insecure PermissionCVE-2020-7979 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 27, 2020An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriCVE-2019-5474 · Websites & servers · GitLab · reported by support@hackerone.comMedium 6.5
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests aCVE-2019-15590 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any pCVE-2019-15582 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to CVE-2019-15581 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 5, 2020In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group SearcCVE-2019-19629 · Websites & servers · Gitlab · reported by MITREHigh 7.5
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 5, 2020In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and CVE-2019-19628 · Websites & servers · Gitlab · reported by MITRECritical 9.8
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 5, 2020GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext.CVE-2019-19314 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 5, 2020GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service.CVE-2019-19313 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 5, 2020GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control.CVE-2019-19312 · Websites & servers · Gitlab · reported by MITREMedium 5.8
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 3, 2020GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.CVE-2019-19311 · Websites & servers · Gitlab · reported by MITREMedium 5.4
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Dec 18, 2019An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return CVE-2019-5487 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 5.3
An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
Jul 10, 2019GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allCVE-2018-19584 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jul 10, 2019GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized useCVE-2018-19582 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jul 10, 2019GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that CVE-2018-19581 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jul 10, 2019GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page.CVE-2018-19579 · Websites & servers · Gitlab · reported by MITREMedium 5.4
GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jul 10, 2019GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger TraciCVE-2018-19578 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.