| CVE-2020-7968 | ALTO7.5 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. | 05/02/2020 |
| CVE-2020-7967 | MÉDIO4.3 | GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). | 05/02/2020 |
| CVE-2020-7966 | ALTO7.5 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. | 05/02/2020 |
| CVE-2020-8114 | CRÍTICO9.8 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission | 05/02/2020 |
| CVE-2020-7979 | MÉDIO5.3 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission | 05/02/2020 |
| CVE-2013-4583 | ALTO8.8 | The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories. | 28/01/2020 |
| CVE-2013-4582 | MÉDIO6.5 | The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the | 28/01/2020 |
| CVE-2019-5474 | MÉDIO6.5 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions. | 28/01/2020 |
| CVE-2019-5472 | ALTO7.5 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. | 28/01/2020 |
| CVE-2019-5470 | ALTO7.5 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information. | 28/01/2020 |
| CVE-2019-5468 | ALTO8.8 | An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account. | 28/01/2020 |
| CVE-2019-5466 | MÉDIO4.3 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. | 28/01/2020 |
| CVE-2019-5465 | MÉDIO4.3 | An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID. | 28/01/2020 |
| CVE-2019-5464 | CRÍTICO9.8 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized. | 28/01/2020 |
| CVE-2019-5462 | ALTO8.8 | A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. | 28/01/2020 |
| CVE-2019-15590 | ALTO7.5 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration | 28/01/2020 |
| CVE-2019-15586 | MÉDIO6.1 | A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. | 28/01/2020 |
| CVE-2019-15585 | CRÍTICO9.8 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account. | 28/01/2020 |
| CVE-2019-15583 | ALTO7.5 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API. | 28/01/2020 |
| CVE-2019-15582 | MÉDIO5.3 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment. | 28/01/2020 |