Gitlab
Page 10 of 11 — Gitlab CVEs from a corpus of 1093, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22243 | Medium | 5.0 | 2021-08-25 | Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain… |
CVE-2021-22242 | High | 8.7 | 2021-08-25 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerabili… |
CVE-2021-22237 | Medium | 6.6 | 2021-08-25 | Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability… |
CVE-2021-22236 | Medium | 5.5 | 2021-08-25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present… |
CVE-2021-22253 | Medium | 4.9 | 2021-08-23 | Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protecte… |
CVE-2021-22252 | Medium | 6.5 | 2021-08-23 | A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should on… |
CVE-2021-22251 | Medium | 4.3 | 2021-08-23 | Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain th… |
CVE-2021-22249 | Medium | 4.3 | 2021-08-23 | A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group |
CVE-2021-22248 | Medium | 5.3 | 2021-08-23 | Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information fo… |
CVE-2021-22254 | Low | 3.1 | 2021-08-20 | Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 a… |
CVE-2021-22246 | High | 7.7 | 2021-08-20 | A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. |
CVE-2021-22238 | Medium | 6.8 | 2021-08-20 | An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. |
CVE-2021-22234 | Critical | 9.6 | 2021-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and al… |
CVE-2021-22241 | High | 8.7 | 2021-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specific… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2021-22233 | Medium | 4.3 | 2021-07-07 | An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details |
CVE-2021-22225 | Medium | 4.7 | 2021-07-07 | Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a spec… |
CVE-2021-22224 | High | 7.1 | 2021-07-07 | A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call… |
CVE-2021-22231 | Low | 3.5 | 2021-07-07 | A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a spec… |
CVE-2021-22230 | Medium | 4.9 | 2021-07-07 | Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later throu… |
CVE-2021-22227 | Medium | 6.1 | 2021-07-07 | A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and… |
CVE-2021-22228 | Medium | 6.5 | 2021-07-06 | An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 1… |
CVE-2021-22223 | Medium | 6.1 | 2021-07-06 | Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf… |
CVE-2021-22232 | Low | 3.5 | 2021-07-06 | HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE |
CVE-2021-22229 | Medium | 5.9 | 2021-07-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal… |
CVE-2021-22226 | Medium | 6.5 | 2021-07-06 | Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9 |
CVE-2021-32823 | Low | 3.7 | 2021-06-24 | In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in… |
CVE-2021-22181 | High | 7.7 | 2021-06-11 | A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust… |
CVE-2021-22175 | Medium | 6.8 | 2021-06-11 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5… |
CVE-2021-22220 | Medium | 6.1 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. |
CVE-2021-22216 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-22221 | Medium | 6.5 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versi… |
CVE-2021-22219 | Medium | 4.4 | 2021-06-08 | All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22217 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-22213 | High | 8.8 | 2021-06-08 | A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the v… |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22215 | High | 7.5 | 2021-06-08 | An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations… |
CVE-2021-22214 | Medium | 6.8 | 2021-06-08 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting fro… |
CVE-2021-22210 | Medium | 5.3 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring… |
CVE-2021-22209 | High | 7.5 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted… |
CVE-2021-22208 | Medium | 4.3 | 2021-05-06 | An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for is… |
CVE-2021-22206 | Medium | 6.8 | 2021-05-06 | An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able… |
CVE-2021-22211 | Low | 3.1 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a… |
CVE-2021-22205 | Critical | 10.0 | 2021-04-23 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fi… |
CVE-2021-22199 | Low | 3.5 | 2021-04-22 | An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used. |
CVE-2021-22190 | High | 8.5 | 2021-04-12 | A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token |
CVE-2021-22203 | High | 7.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all… |
CVE-2021-22202 | Low | 2.4 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks throug… |
CVE-2021-22201 | Critical | 9.6 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server. |
CVE-2021-22200 | Medium | 5.9 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal… |
CVE-2021-22198 | Medium | 4.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of publ… |
CVE-2021-22197 | Low | 3.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific ri… |
CVE-2021-22196 | Medium | 6.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge reque… |
CVE-2021-22195 | High | 8.6 | 2021-04-01 | Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system |
CVE-2021-22177 | Medium | 4.3 | 2021-04-01 | Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via git… |
CVE-2021-22194 | Medium | 5.7 | 2021-03-26 | In all versions of GitLab, marshalled session keys were being stored in Redis. |
CVE-2021-22184 | Medium | 6.2 | 2021-03-26 | An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't pro… |
CVE-2021-22180 | Medium | 4.3 | 2021-03-26 | An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analyt… |
CVE-2021-22172 | Medium | 4.3 | 2021-03-26 | Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page |
CVE-2021-22169 | Medium | 4.3 | 2021-03-24 | An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages. |
CVE-2021-22193 | Low | 3.5 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name fo… |
CVE-2021-22192 | Critical | 9.9 | 2021-03-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on t… |
CVE-2021-22186 | Medium | 4.9 | 2021-03-24 | An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners |
CVE-2021-22185 | Medium | 5.4 | 2021-03-24 | Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a speciall… |
CVE-2021-22179 | Medium | 5.4 | 2021-03-24 | A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature. |
CVE-2021-22178 | Medium | 5.0 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. |
CVE-2021-22176 | Medium | 4.3 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on… |
CVE-2021-22189 | Medium | 5.9 | 2021-03-04 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that… |
CVE-2021-22183 | Medium | 4.1 | 2021-03-04 | An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be explo… |
CVE-2021-22188 | Medium | 5.3 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via… |
CVE-2021-22182 | Low | 3.5 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. |
CVE-2021-22187 | Medium | 4.3 | 2021-03-02 | An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pend… |
CVE-2021-22171 | High | 7.3 | 2021-01-15 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a malic… |
CVE-2021-22168 | Medium | 4.3 | 2021-01-15 | A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. |
CVE-2021-22167 | Medium | 5.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporar… |
CVE-2021-22166 | Medium | 5.3 | 2021-01-15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method |
CVE-2020-26414 | Medium | 4.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution tim… |
CVE-2020-26411 | Medium | 4.3 | 2020-12-11 | A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Usin… |
CVE-2020-26417 | Medium | 5.3 | 2020-12-11 | Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5… |
CVE-2020-26416 | Medium | 4.0 | 2020-12-11 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=… |
CVE-2020-26415 | Medium | 4.3 | 2020-12-11 | Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12… |
CVE-2020-26413 | Medium | 5.3 | 2020-12-11 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email… |
CVE-2020-26412 | Low | 3.1 | 2020-12-11 | Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. |
CVE-2020-26408 | Medium | 5.3 | 2020-12-11 | A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker… |
CVE-2020-13357 | Medium | 4.3 | 2020-12-11 | An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user… |
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |
CVE-2020-26407 | Medium | 5.5 | 2020-12-10 | A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site sc… |
CVE-2020-13359 | High | 7.6 | 2020-11-19 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the… |
CVE-2020-13356 | High | 8.2 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read… |
CVE-2020-13355 | High | 7.5 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwri… |
CVE-2020-26405 | High | 7.1 | 2020-11-17 | Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Aff… |
CVE-2020-13349 | Medium | 4.3 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Searc… |
CVE-2020-13348 | Medium | 5.7 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch witho… |
CVE-2020-13351 | Medium | 6.5 | 2020-11-17 | Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on… |
CVE-2020-13350 | Low | 3.1 | 2020-11-17 | CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runne… |
CVE-2020-26406 | Medium | 5.3 | 2020-11-17 | Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to… |
CVE-2020-13358 | Medium | 4.7 | 2020-11-17 | A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions a… |
CVE-2020-13354 | Medium | 4.3 | 2020-11-17 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of ba… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-13352 | Low | 3.7 | 2020-11-17 | Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10… |