GitLab
Page 15 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9224 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9223 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9222 | High | 8.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2019-9220 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resou… |
CVE-2019-9219 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9217 | Critical | 9.8 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Mis… |
CVE-2019-9179 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9178 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9176 | Medium | 6.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF. |
CVE-2019-9175 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9174 | Critical | 10.0 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF. |
CVE-2019-9172 | Medium | 5.9 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9171 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9170 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-7155 | Medium | 6.5 | 2019-04-16 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has In… |
CVE-2019-6796 | Medium | 6.1 | 2019-04-11 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2)… |
CVE-2018-20229 | High | 7.5 | 2019-04-04 | GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal. |
CVE-2018-20144 | High | 7.5 | 2019-03-28 | GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control. |
CVE-2018-19856 | High | 7.5 | 2019-03-26 | GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API. |
CVE-2019-6240 | High | 7.5 | 2019-03-25 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. |
CVE-2018-18843 | Critical | 10.0 | 2018-12-04 | The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF. |
CVE-2018-18648 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-18647 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization. |
CVE-2018-18646 | High | 8.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF. |
CVE-2018-18645 | Medium | 4.3 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exp… |
CVE-2018-18644 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Ex… |
CVE-2018-18642 | Medium | 6.1 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS. |
CVE-2018-18641 | Critical | 9.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of S… |
CVE-2018-18640 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-17976 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic… |
CVE-2018-17975 | Medium | 5.3 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the G… |
CVE-2018-17939 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information E… |
CVE-2018-18649 | Critical | 9.8 | 2018-11-29 | An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for… |
CVE-2018-16051 | Medium | 6.5 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload File… |
CVE-2018-16050 | Medium | 6.1 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request… |
CVE-2018-16049 | Critical | 9.8 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Discl… |
CVE-2018-16048 | Medium | 6.5 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorizatio… |
CVE-2018-12607 | Medium | 5.4 | 2018-08-03 | An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature cont… |
CVE-2018-12606 | Medium | 5.4 | 2018-08-03 | An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a per… |
CVE-2018-12605 | Medium | 5.4 | 2018-08-03 | An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowin… |
CVE-2018-14606 | Medium | 5.4 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone… |
CVE-2018-14605 | Medium | 5.4 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the branch n… |
CVE-2018-14604 | Medium | 6.1 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip… |
CVE-2018-14603 | High | 8.8 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test fe… |
CVE-2018-14602 | High | 7.5 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can oc… |
CVE-2018-14601 | High | 7.5 | 2018-07-27 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2. A Denial of Service can occur because Markdown rendering times are slo… |
CVE-2018-14364 | Critical | 9.8 | 2018-07-18 | GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant… |
CVE-2017-0921 | High | 8.1 | 2018-07-03 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController com… |
CVE-2017-0919 | High | 7.5 | 2018-07-03 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resul… |
CVE-2018-10379 | Medium | 6.1 | 2018-05-31 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Is… |
CVE-2018-8801 | Medium | 6.5 | 2018-04-25 | GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component. |
CVE-2018-9244 | Medium | 6.1 | 2018-04-05 | GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to c… |
CVE-2018-9243 | Medium | 6.1 | 2018-04-05 | GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads t… |
CVE-2018-8971 | Critical | 9.8 | 2018-03-24 | The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing… |
CVE-2017-0920 | Medium | 4.3 | 2018-03-22 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::Crea… |
CVE-2018-3710 | High | 7.8 | 2018-03-21 | Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execu… |
CVE-2017-0927 | Medium | 6.5 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deploy… |
CVE-2017-0926 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2017-0924 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting. |
CVE-2017-0923 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting. |
CVE-2017-0922 | High | 7.5 | 2018-03-21 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an inform… |
CVE-2017-0918 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. |
CVE-2017-0917 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2017-0914 | High | 7.5 | 2018-03-21 | Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclos… |
CVE-2014-8540 | Medium | 6.5 | 2018-01-05 | The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permis… |
CVE-2017-17716 | Medium | 5.9 | 2017-12-17 | GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announceme… |
CVE-2017-12426 | High | 8.8 | 2017-08-14 | GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, an… |
CVE-2017-11438 | Medium | 6.3 | 2017-08-02 | GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add the… |
CVE-2017-11437 | Medium | 6.5 | 2017-08-02 | GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirr… |
CVE-2017-8778 | Medium | 6.1 | 2017-05-04 | GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document. |
CVE-2017-0882 | Medium | 6.3 | 2017-03-28 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7… |
CVE-2016-9469 | High | 8.2 | 2017-03-28 | Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitL… |
CVE-2016-4340 | High | 8.8 | 2017-01-23 | The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows re… |
CVE-2016-9086 | Medium | 6.5 | 2016-11-03 | GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a u… |
CVE-2013-4489 | | 2014-05-17 | The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrate… | |
CVE-2014-3456 | | 2014-05-13 | Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML vi… | |
CVE-2013-4546 | | 2014-05-13 | The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import U… | |
CVE-2013-4490 | | 2014-05-13 | The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authentica… | |
CVE-2013-4581 | | 2014-05-12 | GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbit… | |
CVE-2013-4580 | | 2014-05-12 | GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate ar… | |
CVE-2013-7316 | | 2014-01-24 | Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a cra… |