GitLab
Page 10 of 15 — GitLab CVEs from a corpus of 1488, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39880 | Medium | 6.5 | 2021-10-05 | A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting fro… |
CVE-2021-39891 | Medium | 5.9 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation… |
CVE-2021-39889 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to… |
CVE-2021-39886 | Low | 2.6 | 2021-10-05 | Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing u… |
CVE-2021-39881 | Low | 3.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which… |
CVE-2021-39870 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a… |
CVE-2021-22264 | Medium | 6.8 | 2021-10-05 | An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-22262 | Medium | 5.4 | 2021-10-05 | Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from… |
CVE-2021-22261 | High | 7.3 | 2021-10-05 | A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 be… |
CVE-2021-22258 | Medium | 4.3 | 2021-10-05 | The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses |
CVE-2021-22257 | Medium | 5.3 | 2021-10-05 | An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-39894 | Medium | 5.4 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Si… |
CVE-2021-39893 | Medium | 5.3 | 2021-10-05 | A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. |
CVE-2021-39888 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3… |
CVE-2021-39884 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are p… |
CVE-2021-39882 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. |
CVE-2021-39878 | Medium | 5.8 | 2021-10-05 | A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary java… |
CVE-2021-39875 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visiting an API endpoint. |
CVE-2021-39872 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through… |
CVE-2021-39869 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project. |
CVE-2021-39867 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Requ… |
CVE-2021-39866 | Medium | 5.4 | 2021-10-05 | A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens. |
CVE-2021-39887 | High | 7.3 | 2021-10-05 | A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary Java… |
CVE-2021-39900 | Low | 2.0 | 2021-10-04 | Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availabi… |
CVE-2021-39899 | Low | 2.9 | 2021-10-04 | In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. The… |
CVE-2021-39896 | Low | 3.8 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the… |
CVE-2021-39885 | High | 8.7 | 2021-10-04 | A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and a… |
CVE-2021-39883 | Medium | 4.3 | 2021-10-04 | Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions s… |
CVE-2021-39879 | Low | 2.2 | 2021-10-04 | Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authenti… |
CVE-2021-39877 | High | 7.7 | 2021-10-04 | A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted… |
CVE-2021-39874 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. |
CVE-2021-39873 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious web… |
CVE-2021-39871 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker maki… |
CVE-2021-39868 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modif… |
CVE-2021-22259 | Medium | 4.3 | 2021-10-04 | A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. |
CVE-2021-22239 | Medium | 5.0 | 2021-09-09 | An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. |
CVE-2021-22256 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status |
CVE-2021-22250 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for… |
CVE-2021-22247 | Medium | 4.3 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics |
CVE-2021-22245 | Low | 2.7 | 2021-08-25 | Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view |
CVE-2021-22244 | Low | 3.1 | 2021-08-25 | Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data |
CVE-2021-22243 | Medium | 5.0 | 2021-08-25 | Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain… |
CVE-2021-22242 | High | 8.7 | 2021-08-25 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerabili… |
CVE-2021-22237 | Medium | 6.6 | 2021-08-25 | Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability… |
CVE-2021-22236 | Medium | 5.5 | 2021-08-25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present… |
CVE-2021-22253 | Medium | 4.9 | 2021-08-23 | Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protecte… |
CVE-2021-22252 | Medium | 6.5 | 2021-08-23 | A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should on… |
CVE-2021-22251 | Medium | 4.3 | 2021-08-23 | Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain th… |
CVE-2021-22249 | Medium | 4.3 | 2021-08-23 | A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group |
CVE-2021-22248 | Medium | 5.3 | 2021-08-23 | Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information fo… |
CVE-2021-22254 | Low | 3.1 | 2021-08-20 | Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 a… |
CVE-2021-22246 | High | 7.7 | 2021-08-20 | A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. |
CVE-2021-22238 | Medium | 6.8 | 2021-08-20 | An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. |
CVE-2021-22234 | Critical | 9.6 | 2021-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and al… |
CVE-2021-22241 | High | 8.7 | 2021-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specific… |
CVE-2021-22240 | Medium | 4.2 | 2021-08-05 | Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled |
CVE-2021-22233 | Medium | 4.3 | 2021-07-07 | An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details |
CVE-2021-22225 | Medium | 4.7 | 2021-07-07 | Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a spec… |
CVE-2021-22224 | High | 7.1 | 2021-07-07 | A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call… |
CVE-2021-22231 | Low | 3.5 | 2021-07-07 | A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a spec… |
CVE-2021-22230 | Medium | 4.9 | 2021-07-07 | Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later throu… |
CVE-2021-22227 | Medium | 6.1 | 2021-07-07 | A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and… |
CVE-2021-22228 | Medium | 6.5 | 2021-07-06 | An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 1… |
CVE-2021-22223 | Medium | 6.1 | 2021-07-06 | Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf… |
CVE-2021-22232 | Low | 3.5 | 2021-07-06 | HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE |
CVE-2021-22229 | Medium | 5.9 | 2021-07-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal… |
CVE-2021-22226 | Medium | 6.5 | 2021-07-06 | Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9 |
CVE-2021-32823 | Low | 3.7 | 2021-06-24 | In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in… |
CVE-2021-22181 | High | 7.7 | 2021-06-11 | A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust… |
CVE-2021-22175 | Medium | 6.8 | 2021-06-11 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5… |
CVE-2021-22220 | Medium | 6.1 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. |
CVE-2021-22216 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-22221 | Medium | 6.5 | 2021-06-08 | An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versi… |
CVE-2021-22219 | Medium | 4.4 | 2021-06-08 | All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22217 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-22213 | High | 8.8 | 2021-06-08 | A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the v… |
CVE-2021-22218 | Low | 2.6 | 2021-06-08 | All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-22215 | High | 7.5 | 2021-06-08 | An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations… |
CVE-2021-22214 | Medium | 6.8 | 2021-06-08 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting fro… |
CVE-2021-22210 | Medium | 5.3 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring… |
CVE-2021-22209 | High | 7.5 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted… |
CVE-2021-22208 | Medium | 4.3 | 2021-05-06 | An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for is… |
CVE-2021-22206 | Medium | 6.8 | 2021-05-06 | An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able… |
CVE-2021-22211 | Low | 3.1 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a… |
CVE-2021-22205 | Critical | 10.0 | 2021-04-23 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fi… |
CVE-2021-22199 | Low | 3.5 | 2021-04-22 | An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used. |
CVE-2021-22190 | High | 8.5 | 2021-04-12 | A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token |
CVE-2021-22203 | High | 7.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all… |
CVE-2021-22202 | Low | 2.4 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks throug… |
CVE-2021-22201 | Critical | 9.6 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server. |
CVE-2021-22200 | Medium | 5.9 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal… |
CVE-2021-22198 | Medium | 4.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of publ… |
CVE-2021-22197 | Low | 3.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific ri… |
CVE-2021-22196 | Medium | 6.3 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge reque… |
CVE-2021-22195 | High | 8.6 | 2021-04-01 | Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system |
CVE-2021-22177 | Medium | 4.3 | 2021-04-01 | Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via git… |
CVE-2021-22194 | Medium | 5.7 | 2021-03-26 | In all versions of GitLab, marshalled session keys were being stored in Redis. |
CVE-2021-22184 | Medium | 6.2 | 2021-03-26 | An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't pro… |
CVE-2021-22180 | Medium | 4.3 | 2021-03-26 | An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analyt… |
CVE-2021-22172 | Medium | 4.3 | 2021-03-26 | Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page |