FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Gitlab -- Multiple Vulnerabilities

Affected packages
12.8.0 <= gitlab-ce < 12.8.2
12.7.0 <= gitlab-ce < 12.7.7
0 <= gitlab-ce < 12.6.8

Details

VuXML ID 62f2182c-5f7a-11ea-abb7-001b217b3468
Discovery 2020-03-04
Entry 2020-03-06

Gitlab reports:

Directory Traversal to Arbitrary File Read

Account Takeover Through Expired Link

Server Side Request Forgery Through Deprecated Service

Group Two-Factor Authentication Requirement Bypass

Stored XSS in Merge Request Pages

Stored XSS in Merge Request Submission Form

Stored XSS in File View

Stored XSS in Grafana Integration

Contribution Analytics Exposed to Non-members

Incorrect Access Control in Docker Registry via Deploy Tokens

Denial of Service via Permission Checks

Denial of Service in Design For Public Issue

Incorrect Access Control via LFS Import

Unescaped HTML in Header

Private Merge Request Titles Leaked via Widget

Project Namespace Exposed via Vulnerability Feedback Endpoint

Denial of Service Through Recursive Requests

Project Authorization Not Being Updated

Incorrect Permission Level For Group Invites

Disclosure of Private Group Epic Information

User IP Address Exposed via Badge images

References

CVE Name CVE-2020-8113
URL https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/