GitLab
Page 14 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15740 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads. |
CVE-2019-15739 | Medium | 6.1 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS… |
CVE-2019-15738 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via em… |
CVE-2019-15737 | Medium | 6.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session managemen… |
CVE-2019-15736 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a den… |
CVE-2019-15734 | Medium | 4.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments c… |
CVE-2019-15733 | Medium | 4.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized user… |
CVE-2019-15732 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restr… |
CVE-2019-15731 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the reposito… |
CVE-2019-15730 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a byp… |
CVE-2019-15728 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insu… |
CVE-2019-15727 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI re… |
CVE-2019-15726 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary… |
CVE-2019-15725 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of privat… |
CVE-2019-15724 | Medium | 6.1 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection. |
CVE-2019-15723 | Medium | 5.3 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass p… |
CVE-2019-15722 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust clie… |
CVE-2019-15721 | Medium | 5.4 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view… |
CVE-2019-16170 | High | 7.1 | 2019-09-16 | An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Contr… |
CVE-2019-7176 | Low | 3.7 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x b… |
CVE-2019-6791 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Contr… |
CVE-2019-6997 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7… |
CVE-2019-6996 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Inc… |
CVE-2019-6995 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It h… |
CVE-2019-6960 | Critical | 9.8 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has In… |
CVE-2019-6795 | Medium | 5.4 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Di… |
CVE-2019-6794 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-6793 | High | 7.0 | 2019-09-09 | An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable… |
CVE-2019-6792 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. Wh… |
CVE-2019-6789 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-6788 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-6786 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Contr… |
CVE-2019-6785 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service… |
CVE-2019-6784 | Medium | 6.1 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2)… |
CVE-2019-6783 | High | 8.8 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a direc… |
CVE-2019-6782 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-11605 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Informat… |
CVE-2019-11549 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly… |
CVE-2019-11548 | Medium | 5.4 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able t… |
CVE-2019-11547 | Medium | 6.1 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding o… |
CVE-2019-11546 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition wh… |
CVE-2019-11545 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved… |
CVE-2019-11544 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. I… |
CVE-2019-5473 | High | 7.2 | 2019-09-09 | An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. |
CVE-2019-5471 | Medium | 5.4 | 2019-09-09 | An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addresse… |
CVE-2019-5467 | Medium | 5.4 | 2019-09-09 | An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability… |
CVE-2019-5463 | Medium | 5.3 | 2019-09-09 | An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was… |
CVE-2019-5461 | Low | 3.5 | 2019-09-09 | An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a… |
CVE-2019-14943 | Critical | 9.8 | 2019-08-29 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. |
CVE-2018-19584 | High | 7.5 | 2019-07-10 | GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that al… |
CVE-2018-19583 | Medium | 6.5 | 2019-07-10 | GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting adm… |
CVE-2018-19582 | Medium | 4.3 | 2019-07-10 | GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized us… |
CVE-2018-19581 | High | 7.5 | 2019-07-10 | GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that… |
CVE-2018-19580 | Medium | 5.3 | 2019-07-10 | All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made. |
CVE-2018-19579 | Medium | 5.4 | 2019-07-10 | GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1. |
CVE-2018-19578 | Medium | 6.5 | 2019-07-10 | GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Trac… |
CVE-2018-19571 | High | 7.7 | 2019-07-10 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. |
CVE-2018-19576 | High | 8.1 | 2019-07-10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest… |
CVE-2018-19575 | Medium | 4.3 | 2019-07-10 | GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue… |
CVE-2018-19574 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authoriza… |
CVE-2018-19573 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields vi… |
CVE-2018-19572 | Medium | 5.9 | 2019-07-10 | GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the G… |
CVE-2018-19570 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecogni… |
CVE-2018-19569 | High | 8.8 | 2019-07-10 | GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows… |
CVE-2018-19577 | Medium | 5.3 | 2019-07-10 | Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability t… |
CVE-2018-19496 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an in… |
CVE-2018-19495 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerabili… |
CVE-2018-19494 | Medium | 4.3 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect a… |
CVE-2018-19493 | Medium | 6.1 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent X… |
CVE-2019-9866 | Medium | 6.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure. |
CVE-2019-9732 | Critical | 9.8 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 1… |
CVE-2019-9485 | Critical | 9.8 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2019-9221 | Medium | 5.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9218 | Critical | 9.8 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-7549 | Medium | 4.3 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorre… |
CVE-2019-7353 | Critical | 9.1 | 2019-05-17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authori… |
CVE-2019-6797 | High | 7.5 | 2019-05-17 | An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token use… |
CVE-2019-6790 | Medium | 4.3 | 2019-05-17 | An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6… |
CVE-2019-6787 | Medium | 6.5 | 2019-05-17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The… |
CVE-2019-6781 | High | 7.5 | 2019-05-17 | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It… |
CVE-2019-5883 | Critical | 9.1 | 2019-05-17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x… |
CVE-2018-20500 | High | 7.5 | 2019-05-17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo… |
CVE-2018-19585 | High | 7.5 | 2019-05-17 | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Gi… |
CVE-2019-10112 | High | 7.5 | 2019-05-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC… |
CVE-2019-10117 | Medium | 6.1 | 2019-05-16 | An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is t… |
CVE-2019-10116 | Medium | 4.3 | 2019-05-16 | An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10115 | Medium | 6.5 | 2019-05-16 | An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10114 | High | 7.5 | 2019-05-16 | An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10113 | High | 7.5 | 2019-05-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4… |
CVE-2019-10111 | Medium | 5.4 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in t… |
CVE-2019-10110 | Medium | 6.5 | 2019-05-15 | An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10109 | Medium | 5.3 | 2019-05-15 | An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10108 | Medium | 5.4 | 2019-05-15 | An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11… |
CVE-2019-10640 | High | 7.5 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation iss… |
CVE-2019-11000 | Medium | 6.5 | 2019-05-10 | An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure. |
CVE-2018-19359 | High | 8.8 | 2019-04-25 | GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control. |
CVE-2018-18643 | Medium | 6.1 | 2019-04-25 | GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. |
CVE-2019-9890 | Critical | 9.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecur… |
CVE-2019-9756 | Critical | 9.8 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 1… |
CVE-2019-9225 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |