Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,568 results · page 25 of 32

Apr 29, 2020GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.CVE-2020-12276 · Websites & servers · Gitlab · reported by MITREMedium 4.8
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 29, 2020GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.CVE-2020-12275 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 22, 2020An issue was discovered in GitLab CE and EE 8.15 through 12.9.2.CVE-2020-11649 · Websites & servers · Gitlab · reported by MITREMedium 6.5
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 22, 2020An issue was discovered in GitLab 10.7.0 and later through 12.9.2.CVE-2020-11506 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 22, 2020An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3.CVE-2020-11505 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.CVE-2020-10981 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.CVE-2020-10980 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.CVE-2020-10979 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.CVE-2020-10978 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.CVE-2020-10977 · Websites & servers · Gitlab · reported by MITREMedium 5.5
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.CVE-2020-10976 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Apr 8, 2020GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.CVE-2020-10975 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.CVE-2020-10956 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specifCVE-2020-10955 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab through 12.9 is affected by a potential DoS in repository archive download.CVE-2020-10954 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab through 12.9 is affected by a potential DoS in repository archive download.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.CVE-2020-10953 · Websites & servers · Gitlab · reported by MITREHigh 7.5
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 27, 2020GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.CVE-2020-10952 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 3.0 through 12.8.1 allows SSRF.CVE-2020-10077 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.1 through 12.8.1 allows XSS.CVE-2020-10076 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.5 through 12.8.1 allows HTML Injection.CVE-2020-10075 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 10.1 through 12.8.1 has Incorrect Access Control.CVE-2020-10074 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 12.4.2 through 12.8.1 allows Denial of Service.CVE-2020-10073 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.1 through 12.8.1 allows XSS.CVE-2020-10092 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 9.3 through 12.8.1 allows XSS.CVE-2020-10091 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 11.7 through 12.8.1 allows Information Disclosure.CVE-2020-10090 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,CVE-2020-10089 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.5 through 12.8.1 has Insecure Permissions.CVE-2020-10088 · Websites & servers · Gitlab · reported by MITREHigh 8.1
GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab before 12.8.2 allows Information Disclosure.CVE-2020-10087 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 10.4 through 12.8.1 allows Directory Traversal.CVE-2020-10086 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.3.5 through 12.8.1 allows Information Disclosure.CVE-2020-10085 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab EE 11.6 through 12.8.1 allows Information Disclosure.CVE-2020-10084 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.7 through 12.8.1 has Insecure Permissions.CVE-2020-10083 · Websites & servers · Gitlab · reported by MITRECritical 9.1
GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.2 through 12.8.1 allows Denial of Service.CVE-2020-10082 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab before 12.8.2 has Incorrect Access Control.CVE-2020-10081 · Websites & servers · Gitlab · reported by MITREMedium 6.5
GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 8.3 through 12.8.1 allows Information Disclosure.CVE-2020-10080 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 7.10 through 12.8.1 has Incorrect Access Control.CVE-2020-10079 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 13, 2020GitLab 12.1 through 12.8.1 allows XSS.CVE-2020-10078 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 12, 2020GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfiCVE-2020-10535 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2.CVE-2019-13121 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2.CVE-2019-13011 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2.CVE-2019-13010 · Websites & servers · Gitlab · reported by MITREMedium 5.9
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2.CVE-2019-13009 · Websites & servers · Gitlab · reported by MITREMedium 6.5
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2.CVE-2019-13007 · Websites & servers · Gitlab · reported by MITREMedium 4.9
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2.CVE-2019-13006 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2.CVE-2019-13005 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2.CVE-2019-13004 · Websites & servers · Gitlab · reported by MITREMedium 5.3
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3.CVE-2019-13003 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2.CVE-2019-13002 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2.CVE-2019-13001 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11.CVE-2019-12446 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.