Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -58,6 +58,37 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Gitlab -- multiple vulnerabilities + + + gitlab + 8.310.5.6 + 8.310.4.6 + 8.310.3.9 + + + + +

GitLab reports:

+
+

SSRF in services and web hooks

+

There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potentially code execution. This issue has been assigned CVE-2018-8801.

+

Gitlab Auth0 integration issue

+

There was an issue with the GitLab omniauth-auth0 configuration which resulted in the Auth0 integration signing in the wrong users.

+
+ + + + CVE-2018-8801 + https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/ + + + 2018-03-20 + 2018-03-27 + + + mozilla -- use-after-free in compositor