| CVE-2019-15581 | MÉDIO5.3 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules. | 28/01/2020 |
| CVE-2019-15579 | MÉDIO5.3 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones. | 28/01/2020 |
| CVE-2019-15578 | MÉDIO5.3 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests. | 28/01/2020 |
| CVE-2019-20144 | MÉDIO4.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-20143 | MÉDIO5.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-20142 | MÉDIO4.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service. | 13/01/2020 |
| CVE-2020-6832 | MÉDIO5.3 | An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects. | 13/01/2020 |
| CVE-2020-5197 | MÉDIO4.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-20148 | MÉDIO5.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-20147 | MÉDIO5.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-20146 | MÉDIO5.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption. | 13/01/2020 |
| CVE-2019-20145 | MÉDIO4.3 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control. | 13/01/2020 |
| CVE-2019-19629 | ALTO7.5 | In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration. | 05/01/2020 |
| CVE-2019-19628 | CRÍTICO9.8 | In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions. | 05/01/2020 |
| CVE-2019-19314 | ALTO7.5 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. | 05/01/2020 |
| CVE-2019-19313 | ALTO7.5 | GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits. | 05/01/2020 |
| CVE-2019-19312 | MÉDIO5.8 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API. | 05/01/2020 |
| CVE-2019-19310 | MÉDIO4.9 | GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. | 03/01/2020 |
| CVE-2019-19309 | MÉDIO4.3 | GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. | 03/01/2020 |
| CVE-2019-19263 | MÉDIO4.3 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. | 03/01/2020 |