Gitlab ≫ GitLab

In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.

Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a grou...

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.

An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.

GitLab EE 11.0 and later through 12.7.2 allows XSS.

GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).

GitLab through 12.7.2 allows XSS.

GitLab EE 10.1 through 12.7.2 allows Information Disclosure.

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.