Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,568 results · page 24 of 32
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13298 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.2
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13297 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4.CVE-2020-13317 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13314 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13313 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13312 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13311 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13318 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13316 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.CVE-2020-13300 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13299 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.1
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13289 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13287 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.CVE-2020-13284 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.CVE-2020-13286 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.4
For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import featureCVE-2020-13281 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.CVE-2020-13285 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.3
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.CVE-2020-13283 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.3
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improperCVE-2020-13282 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2020For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.CVE-2020-13280 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GCVE-2020-5415 · Other software · VMware Tanzu · reported by security@pivotal.ioCritical 10
Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.
- Product
- Concourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtanzu.vmware.com
Aug 12, 2020In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.CVE-2020-13291 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.1
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications pageCVE-2020-13290 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs pageCVE-2020-13288 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.5
In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.CVE-2020-13295 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.4
For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
- Product
- GitLab Runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.CVE-2020-13294 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.2
In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.CVE-2020-13293 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.3
In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2020In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.CVE-2020-13292 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.6
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.CVE-2020-2228 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
- Product
- Jenkins Gitlab Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 7, 2020GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.CVE-2020-15525 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Jun 22, 2020Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user systemCVE-2020-13279 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.6
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
- Product
- gitlab-vscode-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster tokenCVE-2020-13264 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized usersCVE-2020-13263 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source codeCVE-2020-13261 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1CVE-2020-13276 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.4
User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1CVE-2020-13275 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through CVE-2020-13274 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1CVE-2020-13273 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flowCVE-2020-13272 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verificationCVE-2020-13265 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on beCVE-2020-13262 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5CVE-2020-13277 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.3
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13CVE-2020-13271 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted publCVE-2020-13270 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.5
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later throCVE-2020-13269 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents.CVE-2020-13268 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1CVE-2020-13267 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys underCVE-2020-13266 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys under certain conditions
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.CVE-2020-12448 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Apr 29, 2020GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.CVE-2020-12277 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.