GitLab
Page 13 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7971 | Medium | 6.1 | 2020-02-05 | GitLab EE 11.0 and later through 12.7.2 allows XSS. |
CVE-2020-7969 | High | 7.5 | 2020-02-05 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. |
CVE-2020-7968 | High | 7.5 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. |
CVE-2020-7967 | Medium | 4.3 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). |
CVE-2020-7966 | High | 7.5 | 2020-02-05 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. |
CVE-2020-8114 | Critical | 9.8 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2020-7979 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2013-4583 | High | 8.8 | 2020-01-28 | The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell… |
CVE-2013-4582 | Medium | 6.5 | 2020-01-28 | The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Editi… |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2019-5472 | High | 7.5 | 2020-01-28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
CVE-2019-5470 | High | 7.5 | 2020-01-28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of… |
CVE-2019-5468 | High | 8.8 | 2020-01-28 | An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked accoun… |
CVE-2019-5466 | Medium | 4.3 | 2020-01-28 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. |
CVE-2019-5465 | Medium | 4.3 | 2020-01-28 | An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly cr… |
CVE-2019-5464 | Critical | 9.8 | 2020-01-28 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is u… |
CVE-2019-5462 | High | 8.8 | 2020-01-28 | A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. |
CVE-2019-15590 | High | 7.5 | 2020-01-28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests… |
CVE-2019-15586 | Medium | 6.1 | 2020-01-28 | A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. |
CVE-2019-15585 | Critical | 9.8 | 2020-01-28 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integratio… |
CVE-2019-15583 | High | 7.5 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to… |
CVE-2019-15582 | Medium | 5.3 | 2020-01-28 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any… |
CVE-2019-15581 | Medium | 5.3 | 2020-01-28 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to… |
CVE-2019-15579 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a… |
CVE-2019-15578 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private proj… |
CVE-2019-20144 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20143 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control. |
CVE-2019-20142 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service. |
CVE-2020-6832 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues… |
CVE-2020-5197 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20148 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20147 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20146 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption. |
CVE-2019-20145 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-19629 | High | 7.5 | 2020-01-05 | In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Sear… |
CVE-2019-19628 | Critical | 9.8 | 2020-01-05 | In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and… |
CVE-2019-19314 | High | 7.5 | 2020-01-05 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. |
CVE-2019-19313 | High | 7.5 | 2020-01-05 | GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and comm… |
CVE-2019-19312 | Medium | 5.8 | 2020-01-05 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still abl… |
CVE-2019-19310 | Medium | 4.9 | 2020-01-03 | GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. |
CVE-2019-19309 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19263 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. |
CVE-2019-19262 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. |
CVE-2019-19261 | High | 8.8 | 2020-01-03 | GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF. |
CVE-2019-19260 | Medium | 5.4 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). |
CVE-2019-19259 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR). |
CVE-2019-19258 | Medium | 5.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19257 | Medium | 5.3 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2). |
CVE-2019-19256 | Medium | 5.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19255 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19311 | Medium | 5.4 | 2020-01-03 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields. |
CVE-2019-19254 | Medium | 5.3 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19088 | Critical | 9.8 | 2020-01-03 | Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. |
CVE-2019-19087 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). |
CVE-2019-19086 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). |
CVE-2018-20507 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Acc… |
CVE-2018-20501 | Medium | 6.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20499 | High | 7.2 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. |
CVE-2018-20498 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20497 | Medium | 5.0 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. |
CVE-2018-20496 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It all… |
CVE-2018-20495 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows… |
CVE-2018-20494 | High | 7.5 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20493 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20491 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. |
CVE-2018-20490 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It all… |
CVE-2018-20489 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20488 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposu… |
CVE-2018-20492 | Medium | 5.3 | 2019-12-26 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2019-15584 | Medium | 6.5 | 2019-12-20 | A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affe… |
CVE-2019-5487 | Medium | 5.3 | 2019-12-18 | An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return… |
CVE-2019-5486 | High | 8.8 | 2019-12-18 | A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an att… |
CVE-2019-5469 | Medium | 6.5 | 2019-12-18 | An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potenti… |
CVE-2019-15591 | Medium | 6.5 | 2019-12-18 | An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge… |
CVE-2019-15589 | High | 8.8 | 2019-12-18 | An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pul… |
CVE-2019-15580 | Medium | 6.5 | 2019-12-18 | An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for… |
CVE-2019-15577 | Medium | 4.3 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups bro… |
CVE-2019-15576 | High | 7.5 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a G… |
CVE-2019-15575 | High | 7.5 | 2019-12-18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope. |
CVE-2019-18456 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insec… |
CVE-2019-18455 | High | 7.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop. |
CVE-2019-18454 | Medium | 6.1 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS. |
CVE-2019-18453 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions. |
CVE-2019-18452 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecu… |
CVE-2019-18451 | Medium | 6.1 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect. |
CVE-2019-18450 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions. |
CVE-2019-18449 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2). |
CVE-2019-18448 | Medium | 6.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control. |
CVE-2019-18447 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions. |
CVE-2019-18446 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2). |
CVE-2019-18459 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of… |
CVE-2019-18458 | Low | 2.7 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4). |
CVE-2019-18457 | High | 8.8 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions. |
CVE-2019-18463 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4). |
CVE-2019-18462 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions. |
CVE-2019-18461 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access… |
CVE-2019-18460 | High | 7.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration… |
CVE-2019-15593 | Medium | 6.5 | 2019-11-22 | GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Commen… |
CVE-2019-15729 | High | 7.5 | 2019-09-17 | An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the la… |
CVE-2019-15741 | Critical | 9.8 | 2019-09-16 | An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation |