CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 10/03/2020 |
| CVE-2019-12430 | 높음8.8 | An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection. | 10/03/2020 |
| CVE-2019-12429 | 보통6.5 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. It has Improper Access Control. | 10/03/2020 |
| CVE-2019-12428 | 심각9.8 | An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization. | 10/03/2020 |
| CVE-2020-8113 | 심각9.8 | GitLab 10.7 and later through 12.7.2 has Incorrect Access Control. | 06/03/2020 |
| CVE-2020-8795 | 높음7.5 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. | 17/02/2020 |
| CVE-2019-12825 | 보통4.3 | Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespac | 17/02/2020 |
| CVE-2019-15594 | 보통4.3 | GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. | 14/02/2020 |
| CVE-2019-15592 | 보통4.3 | GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. | 14/02/2020 |
| CVE-2020-6833 | 높음7.5 | An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling. | 05/02/2020 |
| CVE-2020-7978 | 높음7.5 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. | 05/02/2020 |
| CVE-2020-7977 | 보통5.3 | GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. | 05/02/2020 |
| CVE-2020-7976 | 보통5.3 | GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. | 05/02/2020 |
| CVE-2020-7974 | 보통5.3 | GitLab EE 10.1 through 12.7.2 allows Information Disclosure. | 05/02/2020 |
| CVE-2020-7973 | 보통6.1 | GitLab through 12.7.2 allows XSS. | 05/02/2020 |
| CVE-2020-7972 | 높음7.5 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). | 05/02/2020 |
| CVE-2020-7971 | 보통6.1 | GitLab EE 11.0 and later through 12.7.2 allows XSS. | 05/02/2020 |
| CVE-2020-7969 | 높음7.5 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. | 05/02/2020 |