Bitnami package
gitlab
pkg:bitnami/gitlab
Vulnerabilities (1,073)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13307 | Low | 3.8 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 15, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access. | |
| CVE-2020-13303 | Hig | 7.1 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 15, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project. | |
| CVE-2020-13315 | Low | 3.7 | >= 11.4.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service. | |
| CVE-2020-13310 | Med | 6.5 | >= 1.0.0, < 13.1.3 | 13.1.3 | Sep 14, 2020 | A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service. | |
| CVE-2020-13309 | Med | 5.4 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature. | |
| CVE-2020-13306 | Low | 3.7 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation. | |
| CVE-2020-13305 | Low | 3.5 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project. | |
| CVE-2020-13304 | Low | 3.8 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions. | |
| CVE-2020-13302 | Low | 3.8 | >= 7.11.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password. | |
| CVE-2020-13301 | Med | 5.5 | >= 12.10.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. | |
| CVE-2020-13298 | Hig | 7.2 | >= 13.1.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure. | |
| CVE-2020-13297 | Low | 3.8 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint. | |
| CVE-2020-13317 | Med | 6.5 | >= 12.6.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository. | |
| CVE-2020-13314 | Low | 3.7 | >= 7.1.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages. | |
| CVE-2020-13313 | Med | 4.3 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control. | |
| CVE-2020-13312 | Med | 6.5 | >= 7.7.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter. | |
| CVE-2020-13311 | Med | 4.3 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface. | |
| CVE-2020-13318 | Med | 6.4 | >= 12.6.0, < 13.0.12 | 13.0.12 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack. | |
| CVE-2020-13316 | Med | 5.4 | >= 1.0.0, < 13.1.10 | 13.1.10 | Sep 14, 2020 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line. | |
| CVE-2020-13300 | Hig | 8.0 | >= 13.3.0, < 13.3.4 | 13.3.4 | Sep 14, 2020 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. |
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.
- affected >= 11.4.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.
- affected >= 1.0.0, < 13.1.3fixed 13.1.3
A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.
- affected >= 7.11.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.
- affected >= 12.10.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.
- affected >= 13.1.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.
- affected >= 12.6.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository.
- affected >= 7.1.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.
- affected >= 7.7.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface.
- affected >= 12.6.0, < 13.0.12fixed 13.0.12
A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.
- affected >= 1.0.0, < 13.1.10fixed 13.1.10
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.
- affected >= 13.3.0, < 13.3.4fixed 13.3.4
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.
Page 49 of 54