FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Gitlab -- Multiple vulnerabilities

Affected packages
13.8.0 <= gitlab-ce < 13.8.2
13.7.0 <= gitlab-ce < 13.7.6
11.8 <= gitlab-ce < 13.6.6

Details

VuXML ID 66d1c277-652a-11eb-bb3f-001b217b3468
Discovery 2021-02-01
Entry 2021-02-02

Gitlab reports:

Stored XSS in merge request

Stored XSS in epic's pages

Sensitive GraphQL variables exposed in structured log

Guest user can see tag names in private projects

Information disclosure via error message

DNS rebinding protection bypass

Validate existence of private project

References

CVE Name CVE-2021-22169
CVE Name CVE-2021-22172
URL https://about.gitlab.com/blog/2021/02/01/security-release-gitlab-13-8-2-released/