Gitlab
Page 11 of 11 — Gitlab CVEs from a corpus of 1093, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13327 | Medium | 6.0 | 2020-10-22 | An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all v… |
CVE-2020-13341 | Medium | 4.9 | 2020-10-12 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer… |
CVE-2020-13344 | Medium | 5.7 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows… |
CVE-2020-13340 | High | 8.7 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log |
CVE-2020-13339 | Medium | 5.5 | 2020-10-08 | An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the… |
CVE-2020-13342 | Low | 2.7 | 2020-10-07 | An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email |
CVE-2020-13347 | Critical | 9.1 | 2020-10-07 | A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows syste… |
CVE-2020-13346 | Medium | 6.5 | 2020-10-07 | Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential… |
CVE-2020-13335 | Medium | 4.3 | 2020-10-07 | Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their grou… |
CVE-2020-13334 | Medium | 5.9 | 2020-10-07 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attri… |
CVE-2020-13345 | Medium | 5.5 | 2020-10-06 | An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes |
CVE-2020-13343 | High | 7.5 | 2020-10-06 | An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template |
CVE-2020-13333 | Medium | 4.3 | 2020-10-06 | A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check whic… |
CVE-2020-13338 | Medium | 5.4 | 2020-10-02 | An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when ed… |
CVE-2020-13337 | High | 7.2 | 2020-10-02 | An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name. |
CVE-2020-13336 | Medium | 4.0 | 2020-09-30 | An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature. |
CVE-2020-13331 | Medium | 5.4 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges. |
CVE-2020-13330 | Medium | 4.4 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature. |
CVE-2020-13329 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature. |
CVE-2020-13328 | Medium | 4.8 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files A… |
CVE-2020-13326 | Medium | 4.3 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed. |
CVE-2020-13325 | High | 7.1 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially re… |
CVE-2020-13324 | Medium | 6.5 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API. |
CVE-2020-13323 | High | 7.7 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos |
CVE-2020-13322 | High | 7.2 | 2020-09-30 | A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy to… |
CVE-2020-13321 | High | 8.3 | 2020-09-30 | A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added. |
CVE-2020-13320 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard. |
CVE-2020-13319 | Medium | 4.3 | 2020-09-30 | An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue. |
CVE-2020-13296 | Medium | 6.5 | 2020-09-30 | An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens |
CVE-2020-13308 | Low | 2.7 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from ac… |
CVE-2020-13307 | Low | 3.8 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication… |
CVE-2020-13303 | High | 7.1 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can acce… |
CVE-2020-13315 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one co… |
CVE-2020-13310 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending m… |
CVE-2020-13309 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirror… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-13305 | Low | 3.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user f… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-13302 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions an… |
CVE-2020-13301 | Medium | 5.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. |
CVE-2020-13298 | High | 7.2 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplie… |
CVE-2020-13297 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user coul… |
CVE-2020-13317 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a… |
CVE-2020-13314 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be… |
CVE-2020-13313 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to t… |
CVE-2020-13312 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a spec… |
CVE-2020-13311 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessin… |
CVE-2020-13318 | Medium | 6.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume… |
CVE-2020-13316 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository… |
CVE-2020-13300 | High | 8.0 | 2020-09-14 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. |
CVE-2020-13299 | High | 8.1 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could r… |
CVE-2020-13289 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activat… |
CVE-2020-13287 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confid… |
CVE-2020-13284 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token |
CVE-2020-13286 | Medium | 6.4 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery. |
CVE-2020-13281 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature |
CVE-2020-13285 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. |
CVE-2020-13283 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-13280 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. |
CVE-2020-13291 | High | 8.1 | 2020-08-12 | In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. |
CVE-2020-13290 | High | 7.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page |
CVE-2020-13288 | Medium | 5.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page |
CVE-2020-13295 | Medium | 5.4 | 2020-08-10 | For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF. |
CVE-2020-13294 | Medium | 4.2 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application. |
CVE-2020-13293 | Medium | 6.3 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash. |
CVE-2020-13292 | Critical | 9.6 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. |
CVE-2020-15525 | Medium | 5.3 | 2020-07-07 | GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint. |
CVE-2020-13279 | High | 8.6 | 2020-06-22 | Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system |
CVE-2020-13264 | Medium | 5.3 | 2020-06-19 | Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token |
CVE-2020-13263 | High | 7.5 | 2020-06-19 | An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized user… |
CVE-2020-13261 | Medium | 5.3 | 2020-06-19 | Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code |
CVE-2020-13276 | High | 7.4 | 2020-06-19 | User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1 |
CVE-2020-13275 | High | 8.0 | 2020-06-19 | A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 |
CVE-2020-13274 | High | 7.5 | 2020-06-19 | A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through… |
CVE-2020-13273 | High | 7.5 | 2020-06-19 | A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 |
CVE-2020-13272 | High | 7.5 | 2020-06-19 | OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow |
CVE-2020-13265 | Medium | 4.3 | 2020-06-19 | User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification |
CVE-2020-13262 | Medium | 6.1 | 2020-06-19 | Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on b… |
CVE-2020-13277 | Medium | 6.3 | 2020-06-19 | An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5 |
CVE-2020-14155 | Medium | 5.3 | 2020-06-15 | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. |
CVE-2020-13271 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 1… |
CVE-2020-13270 | High | 7.5 | 2020-06-10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted pub… |
CVE-2020-13269 | Medium | 6.1 | 2020-06-10 | A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later thr… |
CVE-2020-13268 | Medium | 5.3 | 2020-06-10 | A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerab… |
CVE-2020-13267 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1 |
CVE-2020-13266 | Medium | 4.3 | 2020-06-09 | Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys unde… |
CVE-2020-12448 | Medium | 5.3 | 2020-05-07 | GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. |
CVE-2020-12277 | Medium | 5.3 | 2020-04-29 | GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated. |
CVE-2020-12276 | Medium | 4.8 | 2020-04-29 | GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature. |
CVE-2020-12275 | Medium | 5.3 | 2020-04-29 | GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API. |
CVE-2020-11649 | Medium | 6.5 | 2020-04-22 | An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. |
CVE-2020-11506 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensi… |
CVE-2020-11505 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse… |
CVE-2020-10981 | Medium | 4.3 | 2020-04-08 | GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. |
CVE-2020-10980 | Critical | 9.8 | 2020-04-08 | GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration. |
CVE-2020-10979 | Medium | 4.3 | 2020-04-08 | GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users. |
CVE-2020-10978 | Medium | 5.3 | 2020-04-08 | GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API. |
CVE-2020-10977 | Medium | 5.5 | 2020-04-08 | GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. |
CVE-2020-10976 | High | 7.5 | 2020-04-08 | GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget. |