GitLab
Page 12 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13295 | Medium | 5.4 | 2020-08-10 | For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF. |
CVE-2020-13294 | Medium | 4.2 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application. |
CVE-2020-13293 | Medium | 6.3 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash. |
CVE-2020-13292 | Critical | 9.6 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. |
CVE-2020-15525 | Medium | 5.3 | 2020-07-07 | GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint. |
CVE-2020-13279 | High | 8.6 | 2020-06-22 | Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system |
CVE-2020-13264 | Medium | 5.3 | 2020-06-19 | Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token |
CVE-2020-13263 | High | 7.5 | 2020-06-19 | An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized user… |
CVE-2020-13261 | Medium | 5.3 | 2020-06-19 | Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code |
CVE-2020-13276 | High | 7.4 | 2020-06-19 | User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1 |
CVE-2020-13275 | High | 8.0 | 2020-06-19 | A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 |
CVE-2020-13274 | High | 7.5 | 2020-06-19 | A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through… |
CVE-2020-13273 | High | 7.5 | 2020-06-19 | A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 |
CVE-2020-13272 | High | 7.5 | 2020-06-19 | OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow |
CVE-2020-13265 | Medium | 4.3 | 2020-06-19 | User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification |
CVE-2020-13262 | Medium | 6.1 | 2020-06-19 | Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on b… |
CVE-2020-13277 | Medium | 6.3 | 2020-06-19 | An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5 |
CVE-2020-14155 | Medium | 5.3 | 2020-06-15 | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. |
CVE-2020-13271 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 1… |
CVE-2020-13270 | High | 7.5 | 2020-06-10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted pub… |
CVE-2020-13269 | Medium | 6.1 | 2020-06-10 | A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later thr… |
CVE-2020-13268 | Medium | 5.3 | 2020-06-10 | A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerab… |
CVE-2020-13267 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1 |
CVE-2020-13266 | Medium | 4.3 | 2020-06-09 | Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update permissions of other users' deploy keys unde… |
CVE-2020-12448 | Medium | 5.3 | 2020-05-07 | GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. |
CVE-2020-12277 | Medium | 5.3 | 2020-04-29 | GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated. |
CVE-2020-12276 | Medium | 4.8 | 2020-04-29 | GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature. |
CVE-2020-12275 | Medium | 5.3 | 2020-04-29 | GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API. |
CVE-2020-11649 | Medium | 6.5 | 2020-04-22 | An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. |
CVE-2020-11506 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensi… |
CVE-2020-11505 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse… |
CVE-2020-10981 | Medium | 4.3 | 2020-04-08 | GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. |
CVE-2020-10980 | Critical | 9.8 | 2020-04-08 | GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration. |
CVE-2020-10979 | Medium | 4.3 | 2020-04-08 | GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users. |
CVE-2020-10978 | Medium | 5.3 | 2020-04-08 | GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API. |
CVE-2020-10977 | Medium | 5.5 | 2020-04-08 | GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. |
CVE-2020-10976 | High | 7.5 | 2020-04-08 | GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget. |
CVE-2020-10975 | Medium | 4.3 | 2020-04-08 | GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page. |
CVE-2020-10956 | Critical | 9.8 | 2020-03-27 | GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature. |
CVE-2020-10955 | Medium | 6.5 | 2020-03-27 | GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under speci… |
CVE-2020-10954 | High | 7.5 | 2020-03-27 | GitLab through 12.9 is affected by a potential DoS in repository archive download. |
CVE-2020-10953 | High | 7.5 | 2020-03-27 | In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. |
CVE-2020-10952 | Medium | 6.5 | 2020-03-27 | GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images. |
CVE-2020-10077 | Critical | 9.8 | 2020-03-13 | GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery ri… |
CVE-2020-10076 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests. |
CVE-2020-10075 | Medium | 6.1 | 2020-03-13 | GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via u… |
CVE-2020-10074 | Critical | 9.8 | 2020-03-13 | GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link. |
CVE-2020-10073 | High | 7.5 | 2020-03-13 | GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could im… |
CVE-2020-10092 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration. |
CVE-2020-10091 | Medium | 6.1 | 2020-03-13 | GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types. |
CVE-2020-10090 | Medium | 5.3 | 2020-03-13 | GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. |
CVE-2020-10089 | High | 7.5 | 2020-03-13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, |
CVE-2020-10088 | High | 8.1 | 2020-03-13 | GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permi… |
CVE-2020-10087 | High | 7.5 | 2020-03-13 | GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of th… |
CVE-2020-10086 | Medium | 5.3 | 2020-03-13 | GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file r… |
CVE-2020-10085 | Medium | 5.3 | 2020-03-13 | GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles. |
CVE-2020-10084 | Medium | 5.3 | 2020-03-13 | GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exp… |
CVE-2020-10083 | Critical | 9.1 | 2020-03-13 | GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied. |
CVE-2020-10082 | Medium | 5.3 | 2020-03-13 | GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered. |
CVE-2020-10081 | Medium | 6.5 | 2020-03-13 | GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS… |
CVE-2020-10080 | Medium | 5.3 | 2020-03-13 | GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group. |
CVE-2020-10079 | Medium | 5.3 | 2020-03-13 | GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication… |
CVE-2020-10078 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability. |
CVE-2020-10535 | Medium | 5.3 | 2020-03-12 | GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconf… |
CVE-2019-13121 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed… |
CVE-2019-13011 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could… |
CVE-2019-13010 | Medium | 5.9 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific form… |
CVE-2019-13009 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible… |
CVE-2019-13007 | Medium | 4.9 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering… |
CVE-2019-13006 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to vie… |
CVE-2019-13005 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authoriza… |
CVE-2019-13004 | Medium | 5.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments… |
CVE-2019-13003 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion a… |
CVE-2019-13002 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last… |
CVE-2019-13001 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue tha… |
CVE-2019-12446 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. |
CVE-2019-12445 | Medium | 5.4 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a sp… |
CVE-2019-12444 | Medium | 6.1 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persi… |
CVE-2019-12443 | Critical | 9.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabi… |
CVE-2019-12442 | Medium | 6.1 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue w… |
CVE-2019-12441 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which res… |
CVE-2019-12434 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast… |
CVE-2019-12433 | Medium | 5.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow c… |
CVE-2019-12432 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the… |
CVE-2019-12431 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through… |
CVE-2019-12430 | High | 8.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute co… |
CVE-2019-12429 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request… |
CVE-2019-12428 | Critical | 9.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in… |
CVE-2020-8113 | Critical | 9.8 | 2020-03-06 | GitLab 10.7 and later through 12.7.2 has Incorrect Access Control. |
CVE-2020-8795 | High | 7.5 | 2020-02-17 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. |
CVE-2019-12825 | Medium | 4.3 | 2020-02-17 | Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers ca… |
CVE-2019-15594 | Medium | 4.3 | 2020-02-14 | GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. |
CVE-2019-15592 | Medium | 4.3 | 2020-02-14 | GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via… |
CVE-2020-6833 | High | 7.5 | 2020-02-05 | An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling. |
CVE-2020-7978 | High | 7.5 | 2020-02-05 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. |
CVE-2020-7977 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. |
CVE-2020-7976 | Medium | 5.3 | 2020-02-05 | GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. |
CVE-2020-7974 | Medium | 5.3 | 2020-02-05 | GitLab EE 10.1 through 12.7.2 allows Information Disclosure. |
CVE-2020-7973 | Medium | 6.1 | 2020-02-05 | GitLab through 12.7.2 allows XSS. |
CVE-2020-7972 | High | 7.5 | 2020-02-05 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). |