Debian Gitlab vulnerabilities

CVE-2019-18454 [MEDIUM] CVE-2019-18454: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 10.5 through ... An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2023-1098 [MEDIUM] CVE-2023-1098: gitlab - An information disclosure vulnerability has been discovered in GitLab EE/CE affe... An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13345 [MEDIUM] CVE-2020-13345: gitlab - An issue has been discovered in GitLab affecting all versions starting from 10.8... An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes Scope: local sid: resolved (fixed in 13.2.10-1)

CVE-2019-6795 [MEDIUM] CVE-2019-6795: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8... An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering. Scope: local sid: resolved (fixed in 11.5.10+dfsg-1)

CVE-2018-19574 [MEDIUM] CVE-2018-19574: gitlab - GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11... GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page. Scope: local sid: resolved (fixed in 11.3.11+dfsg-1)

CVE-2018-19570 [MEDIUM] CVE-2018-19570: gitlab - GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before ... GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags. Scope: local sid: resolved (fixed in 11.3.11+dfsg-1)

CVE-2022-2882 [MEDIUM] CVE-2022-2882: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker control

CVE-2018-19573 [MEDIUM] CVE-2018-19573: gitlab - GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 1... GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid. Scope: local sid: resolved (fixed in 11.3.11+dfsg-1)

CVE-2020-13264 [MEDIUM] CVE-2020-13264: gitlab - Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.... Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2018-14606 [MEDIUM] CVE-2018-14606: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7... An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion. Scope: local sid: resolved (fixed in 10.8.7+dfsg-1)

CVE-2018-12606 [MEDIUM] CVE-2018-12606: gitlab - An issue was discovered in GitLab Community Edition and Enterprise Edition befor... An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature. Scope: local sid: resolved (fixed in 10.7.7+dfsg-2)

CVE-2018-12607 [MEDIUM] CVE-2018-12607: gitlab - An issue was discovered in GitLab Community Edition and Enterprise Edition befor... An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding. Scope: local sid: resolved (fixed in 10.7.7+dfsg-2)

CVE-2020-10090 [MEDIUM] CVE-2020-10090: gitlab - GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group co... GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2020-10080 [MEDIUM] CVE-2020-10080: gitlab - GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for cer... GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2018-12605 [MEDIUM] CVE-2018-12605: gitlab - An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.... An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter. Scope: local sid: resolved (fixed in 10.7.7+dfsg-2)

CVE-2019-18452 [MEDIUM] CVE-2019-18452: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 11.3 through ... An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2018-20490 [MEDIUM] CVE-2018-20490: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 11.2.x throug... An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Scope: local sid: resolved (fixed in 11.5.6+dfsg-1)

CVE-2018-20496 [MEDIUM] CVE-2018-20496: gitlab - An issue was discovered in GitLab Community and Enterprise Edition 11.2.x throug... An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Scope: local sid: resolved (fixed in 11.5.6+dfsg-1)

CVE-2018-20491 [MEDIUM] CVE-2018-20491: gitlab - An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11... An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. Scope: local sid: resolved (fixed in 11.5.6+dfsg-1)

CVE-2018-17454 [MEDIUM] CVE-2018-17454: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7... An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen. Scope: local sid: resolved (fixed in 11.1.8+dfsg-2)