Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,568 results · page 23 of 32
Nov 17, 2020An issue has been discovered in GitLab EE affecting all versions starting from 8.12.CVE-2020-13349 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020An issue has been discovered in GitLab EE affecting all versions starting from 10.2.CVE-2020-13348 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on pCVE-2020-13351 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runnerCVE-2020-13350 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3.CVE-2020-26406 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects.CVE-2020-13358 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.7
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.
- Product
- Gitlab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6.CVE-2020-13354 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.CVE-2020-13353 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.5
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
- Product
- Gitaly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group.CVE-2020-13352 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- Product
- GitLab CE/EE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI.CVE-2020-27986 · Other software · sonarsource · reported by MITREHigh 7.5
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
- Product
- sonarqube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all veCVE-2020-13327 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6
An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all versions starting from 13.2.0 before 13.2.10. Insecure Runner Configuration in Kubernetes Environments
- Product
- GitLab Runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2020An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2.CVE-2020-13341 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.9
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2.CVE-2020-13344 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job LogCVE-2020-13340 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview.CVE-2020-13339 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation EmailCVE-2020-13342 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.7
An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1.CVE-2020-13347 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.1
A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.
- Product
- GitLab Runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential iCVE-2020-13346 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their groupCVE-2020-13335 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2020In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribCVE-2020-13334 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.9
In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020An issue has been discovered in GitLab affecting all versions starting from 10.8.CVE-2020-13345 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020An issue has been discovered in GitLab affecting all versions starting from 11.2.CVE-2020-13343 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3.CVE-2020-13333 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2.CVE-2020-13338 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.CVE-2020-13337 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.2
An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13.CVE-2020-13336 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4
An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions prior to 12.10.13.CVE-2020-13331 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions prior to 12.10.13.CVE-2020-13330 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13.CVE-2020-13329 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13.CVE-2020-13328 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.8
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions prior to 13.1.CVE-2020-13326 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions prior 13.1.CVE-2020-13325 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.1
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions prior to 13.1.CVE-2020-13324 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions prior 13.1.CVE-2020-13323 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.7
A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions after 12.9.CVE-2020-13322 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.2
A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy tokens.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020A vulnerability was discovered in GitLab versions prior to 13.1.CVE-2020-13321 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.3
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.CVE-2020-13320 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13.CVE-2020-13319 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6.CVE-2020-13296 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13308 · Websites & servers · GitLab · reported by cve@gitlab.comLow 2.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13307 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13303 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.1
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13315 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1.CVE-2020-13310 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13309 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13306 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13305 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13304 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13302 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13301 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.