GitLab
Page 11 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22185 | Medium | 5.4 | 2021-03-24 | Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a speciall… |
CVE-2021-22179 | Medium | 5.4 | 2021-03-24 | A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature. |
CVE-2021-22178 | Medium | 5.0 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration. |
CVE-2021-22176 | Medium | 4.3 | 2021-03-24 | An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on… |
CVE-2021-22189 | Medium | 5.9 | 2021-03-04 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that… |
CVE-2021-22183 | Medium | 4.1 | 2021-03-04 | An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be explo… |
CVE-2021-22188 | Medium | 5.3 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via… |
CVE-2021-22182 | Low | 3.5 | 2021-03-03 | An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. |
CVE-2021-22187 | Medium | 4.3 | 2021-03-02 | An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pend… |
CVE-2021-22171 | High | 7.3 | 2021-01-15 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a malic… |
CVE-2021-22168 | Medium | 4.3 | 2021-01-15 | A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. |
CVE-2021-22167 | Medium | 5.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporar… |
CVE-2021-22166 | Medium | 5.3 | 2021-01-15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method |
CVE-2020-26414 | Medium | 4.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution tim… |
CVE-2020-26411 | Medium | 4.3 | 2020-12-11 | A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Usin… |
CVE-2020-26417 | Medium | 5.3 | 2020-12-11 | Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5… |
CVE-2020-26416 | Medium | 4.0 | 2020-12-11 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=… |
CVE-2020-26415 | Medium | 4.3 | 2020-12-11 | Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12… |
CVE-2020-26413 | Medium | 5.3 | 2020-12-11 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email… |
CVE-2020-26412 | Low | 3.1 | 2020-12-11 | Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. |
CVE-2020-26408 | Medium | 5.3 | 2020-12-11 | A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker… |
CVE-2020-13357 | Medium | 4.3 | 2020-12-11 | An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user… |
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |
CVE-2020-26407 | Medium | 5.5 | 2020-12-10 | A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site sc… |
CVE-2020-13359 | High | 7.6 | 2020-11-19 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the… |
CVE-2020-13356 | High | 8.2 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read… |
CVE-2020-13355 | High | 7.5 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwri… |
CVE-2020-26405 | High | 7.1 | 2020-11-17 | Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Aff… |
CVE-2020-13349 | Medium | 4.3 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Searc… |
CVE-2020-13348 | Medium | 5.7 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch witho… |
CVE-2020-13351 | Medium | 6.5 | 2020-11-17 | Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on… |
CVE-2020-13350 | Low | 3.1 | 2020-11-17 | CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runne… |
CVE-2020-26406 | Medium | 5.3 | 2020-11-17 | Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to… |
CVE-2020-13358 | Medium | 4.7 | 2020-11-17 | A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions a… |
CVE-2020-13354 | Medium | 4.3 | 2020-11-17 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of ba… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-13352 | Low | 3.7 | 2020-11-17 | Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10… |
CVE-2020-13327 | Medium | 6.0 | 2020-10-22 | An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all v… |
CVE-2020-13341 | Medium | 4.9 | 2020-10-12 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer… |
CVE-2020-13344 | Medium | 5.7 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows… |
CVE-2020-13340 | High | 8.7 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log |
CVE-2020-13339 | Medium | 5.5 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the… |
CVE-2020-13342 | Low | 2.7 | 2020-10-07 | An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email |
CVE-2020-13347 | Critical | 9.1 | 2020-10-07 | A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows syste… |
CVE-2020-13346 | Medium | 6.5 | 2020-10-07 | Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential… |
CVE-2020-13335 | Medium | 4.3 | 2020-10-07 | Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their grou… |
CVE-2020-13334 | Medium | 5.9 | 2020-10-07 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attri… |
CVE-2020-13345 | Medium | 5.5 | 2020-10-06 | An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes |
CVE-2020-13343 | High | 7.5 | 2020-10-06 | An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template |
CVE-2020-13333 | Medium | 4.3 | 2020-10-06 | A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check whic… |
CVE-2020-13338 | Medium | 5.4 | 2020-10-02 | An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when ed… |
CVE-2020-13337 | High | 7.2 | 2020-10-02 | An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name. |
CVE-2020-13336 | Medium | 4.0 | 2020-09-30 | An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature. |
CVE-2020-13331 | Medium | 5.4 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges. |
CVE-2020-13330 | Medium | 4.4 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature. |
CVE-2020-13329 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature. |
CVE-2020-13328 | Medium | 4.8 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files A… |
CVE-2020-13326 | Medium | 4.3 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed. |
CVE-2020-13325 | High | 7.1 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially re… |
CVE-2020-13324 | Medium | 6.5 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API. |
CVE-2020-13323 | High | 7.7 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos |
CVE-2020-13322 | High | 7.2 | 2020-09-30 | A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy to… |
CVE-2020-13321 | High | 8.3 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added. |
CVE-2020-13320 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard. |
CVE-2020-13319 | Medium | 4.3 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue. |
CVE-2020-13296 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens |
CVE-2020-13308 | Low | 2.7 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from ac… |
CVE-2020-13307 | Low | 3.8 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication… |
CVE-2020-13303 | High | 7.1 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can acce… |
CVE-2020-13315 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one co… |
CVE-2020-13310 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending m… |
CVE-2020-13309 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirror… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-13305 | Low | 3.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user f… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-13302 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions an… |
CVE-2020-13301 | Medium | 5.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. |
CVE-2020-13298 | High | 7.2 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplie… |
CVE-2020-13297 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user coul… |
CVE-2020-13317 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a… |
CVE-2020-13314 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be… |
CVE-2020-13313 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to t… |
CVE-2020-13312 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a spec… |
CVE-2020-13311 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessin… |
CVE-2020-13318 | Medium | 6.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume… |
CVE-2020-13316 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository… |
CVE-2020-13300 | High | 8.0 | 2020-09-14 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. |
CVE-2020-13299 | High | 8.1 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could r… |
CVE-2020-13289 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activat… |
CVE-2020-13287 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confid… |
CVE-2020-13284 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token |
CVE-2020-13286 | Medium | 6.4 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery. |
CVE-2020-13281 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature |
CVE-2020-13285 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. |
CVE-2020-13283 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-13280 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. |
CVE-2020-13291 | High | 8.1 | 2020-08-12 | In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. |
CVE-2020-13290 | High | 7.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page |
CVE-2020-13288 | Medium | 5.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page |