Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,568 results · page 26 of 32

Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11.CVE-2019-12445 · Websites & servers · Gitlab · reported by MITREMedium 5.4
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11.CVE-2019-12444 · Websites & servers · Gitlab · reported by MITREMedium 6.1
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11.CVE-2019-12443 · Websites & servers · Gitlab · reported by MITRECritical 9.8
An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11.CVE-2019-12442 · Websites & servers · Gitlab · reported by MITREMedium 6.1
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11.CVE-2019-12441 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11.CVE-2019-12434 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11.CVE-2019-12433 · Websites & servers · Gitlab · reported by MITREMedium 5.3
An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11.CVE-2019-12432 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11.CVE-2019-12431 · Websites & servers · Gitlab · reported by MITREMedium 4.3
An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.11.CVE-2019-12430 · Websites & servers · Gitlab · reported by MITREHigh 8.8
An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11.CVE-2019-12429 · Websites & servers · Gitlab · reported by MITREMedium 6.5
An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. It has Improper Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11.CVE-2019-12428 · Websites & servers · Gitlab · reported by MITRECritical 9.8
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Mar 6, 2020GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.CVE-2020-8113 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 17, 2020In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.CVE-2020-8795 · Websites & servers · Gitlab · reported by MITREHigh 7.5
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 17, 2020Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre.CVE-2019-12825 · Websites & servers · Gitlab · reported by MITREMedium 4.3
Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com atomic111.github.io
Feb 14, 2020GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.CVE-2019-15594 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Feb 14, 2020GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via tCVE-2019-15592 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Feb 5, 2020An issue was discovered in GitLab EE 11.3 and later.CVE-2020-6833 · Websites & servers · Gitlab · reported by MITREHigh 7.5
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.CVE-2020-7978 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.CVE-2020-7977 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.CVE-2020-7976 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 10.1 through 12.7.2 allows Information Disclosure.CVE-2020-7974 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab through 12.7.2 allows XSS.CVE-2020-7973 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab through 12.7.2 allows XSS.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).CVE-2020-7972 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 11.0 and later through 12.7.2 allows XSS.CVE-2020-7971 · Websites & servers · Gitlab · reported by MITREMedium 6.1
GitLab EE 11.0 and later through 12.7.2 allows XSS.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.CVE-2020-7969 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.CVE-2020-7968 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-7967 · Websites & servers · Gitlab · reported by MITREMedium 4.3
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-7966 · Websites & servers · Gitlab · reported by MITREHigh 7.5
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.9 and later through 12.7.2 has Insecure PermissionCVE-2020-8114 · Websites & servers · Gitlab · reported by MITRECritical 9.8
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Feb 5, 2020GitLab EE 8.9 and later through 12.7.2 has Insecure PermissionCVE-2020-7979 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com about.gitlab.com
Jan 28, 2020The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell bCVE-2013-4583 · Websites & servers · GitLab · reported by Red HatHigh 8.8
The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com gitlab.com
Jan 28, 2020The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community EditioCVE-2013-4582 · Websites & servers · GitLab · reported by Red HatMedium 6.5
The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com gitlab.com
Jan 27, 2020An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriCVE-2019-5474 · Websites & servers · GitLab · reported by support@hackerone.comMedium 6.5
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.CVE-2019-5472 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vCVE-2019-5470 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked accountCVE-2019-5468 · Other software · GiltLab · reported by support@hackerone.comHigh 8.8
An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-5466 · Websites & servers · Gitlab · reported by support@hackerone.comMedium 4.3
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
Product
Gitlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly creCVE-2019-5465 · Websites & servers · GitLab · reported by support@hackerone.comMedium 4.3
An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.
Product
GitLab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utCVE-2019-5464 · Websites & servers · GitLab · reported by support@hackerone.comCritical 9.8
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.
Product
GitLab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.CVE-2019-5462 · Websites & servers · GitLab · reported by support@hackerone.comHigh 8.8
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.
Product
GitLab Community Edition and GitLab Enterprise Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Jan 27, 2020An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests aCVE-2019-15590 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.CVE-2019-15586 · Websites & servers · GitLab · reported by support@hackerone.comMedium 6.1
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
Product
Gitlab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integrationCVE-2019-15585 · Websites & servers · GitLab · reported by support@hackerone.comCritical 9.8
Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.
Product
Gitlab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).CVE-2019-15583 · Websites & servers · GitLab · reported by support@hackerone.comHigh 7.5
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.
Product
GitLab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any pCVE-2019-15582 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to CVE-2019-15581 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.
Product
GitLab EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a cCVE-2019-15579 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.
Product
GitLab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 27, 2020An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE).CVE-2019-15578 · Websites & servers · GitLab · reported by support@hackerone.comMedium 5.3
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
Product
GitLab CE/EE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com hackerone.com
Jan 15, 2020Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.CVE-2020-2096 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
Product
Jenkins Gitlab Hook Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.