Filtered by vendor Gitlab
Subscribe
Total
821 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-14602 | 1 Gitlab | 1 Gitlab | 2018-09-18 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames. | |||||
| CVE-2018-14603 | 1 Gitlab | 1 Gitlab | 2018-09-18 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test feature of the System Hooks component. | |||||
| CVE-2018-14606 | 1 Gitlab | 1 Gitlab | 2018-09-18 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion. | |||||
| CVE-2018-14604 | 1 Gitlab | 1 Gitlab | 2018-09-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline. | |||||
| CVE-2018-14605 | 1 Gitlab | 1 Gitlab | 2018-09-18 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the branch name during a Web IDE file commit. | |||||
| CVE-2018-14364 | 1 Gitlab | 1 Gitlab | 2018-09-15 | 7.5 HIGH | 9.8 CRITICAL |
| GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component. | |||||
| CVE-2017-0921 | 1 Gitlab | 1 Gitlab | 2018-09-04 | 6.8 MEDIUM | 8.1 HIGH |
| GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised. | |||||
| CVE-2017-0919 | 1 Gitlab | 1 Gitlab | 2018-09-04 | 5.0 MEDIUM | 7.5 HIGH |
| GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized. | |||||
| CVE-2018-10379 | 1 Gitlab | 1 Gitlab | 2018-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability. | |||||
| CVE-2014-8540 | 1 Gitlab | 1 Gitlab | 2018-01-18 | 4.0 MEDIUM | 6.5 MEDIUM |
| The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks. | |||||
| CVE-2017-17716 | 1 Gitlab | 1 Gitlab | 2018-01-04 | 4.3 MEDIUM | 5.9 MEDIUM |
| GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem. | |||||
| CVE-2017-12426 | 1 Gitlab | 1 Gitlab | 2017-08-25 | 6.8 MEDIUM | 8.8 HIGH |
| GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import. | |||||
| CVE-2017-8778 | 1 Gitlab | 1 Gitlab | 2017-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document. | |||||
| CVE-2016-4340 | 1 Gitlab | 1 Gitlab | 2017-01-25 | 6.5 MEDIUM | 8.8 HIGH |
| The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors. | |||||
| CVE-2016-9086 | 1 Gitlab | 1 Gitlab | 2016-11-29 | 4.0 MEDIUM | 6.5 MEDIUM |
| GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab versions prior to 8.13.0 restricted this feature to administrators only. Starting with version 8.13.0 this feature was made available to all users. This feature did not properly check for symbolic links in user-provided archives and therefore it was possible for an authenticated user to retrieve the contents of any file accessible to the GitLab service account. This included sensitive files such as those that contain secret tokens used by the GitLab service to authenticate users. GitLab CE and EE versions 8.13.0 through 8.13.2, 8.12.0 through 8.12.7, 8.11.0 through 8.11.10, 8.10.0 through 8.10.12, and 8.9.0 through 8.9.11 are affected. | |||||
| CVE-2013-4580 | 1 Gitlab | 1 Gitlab | 2016-05-18 | 6.8 MEDIUM | N/A |
| GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls. | |||||
| CVE-2013-4489 | 1 Gitlab | 1 Gitlab | 2014-05-19 | 6.5 MEDIUM | N/A |
| The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature. | |||||
| CVE-2014-3456 | 1 Gitlab | 1 Gitlab | 2014-05-14 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2013-4546 | 1 Gitlab | 2 Gitlab, Gitlab-shell | 2014-05-14 | 6.5 MEDIUM | N/A |
| The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL. | |||||
| CVE-2013-4490 | 1 Gitlab | 2 Gitlab, Gitlab-shell | 2014-05-14 | 6.5 MEDIUM | N/A |
| The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key. | |||||