Gitlab
Page 9 of 11 — Gitlab CVEs from a corpus of 1093, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0283 | Medium | 4.7 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cau… |
CVE-2022-0249 | Low | 3.1 | 2022-03-28 | A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not… |
CVE-2022-0136 | Medium | 5.4 | 2022-03-28 | A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the… |
CVE-2022-0123 | Medium | 5.9 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL… |
CVE-2021-4191 | Medium | 5.3 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted si… |
CVE-2021-39876 | Medium | 4.3 | 2022-03-28 | In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. |
CVE-2021-39943 | Medium | 4.3 | 2022-02-09 | An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from… |
CVE-2022-0244 | High | 8.6 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorr… |
CVE-2022-0172 | Medium | 5.3 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction f… |
CVE-2022-0154 | High | 7.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions st… |
CVE-2022-0152 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0151 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0125 | Medium | 4.3 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2022-0124 | Medium | 4.3 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is… |
CVE-2022-0093 | Low | 3.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an… |
CVE-2022-0090 | Medium | 6.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way… |
CVE-2021-39946 | High | 8.7 | 2022-01-18 | Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing… |
CVE-2021-39942 | Medium | 4.3 | 2022-01-18 | A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all v… |
CVE-2021-39927 | Low | 3.5 | 2022-01-18 | Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to… |
CVE-2021-39892 | Medium | 4.3 | 2022-01-18 | In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclo… |
CVE-2021-39945 | Low | 2.7 | 2021-12-13 | Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all vers… |
CVE-2021-39944 | High | 7.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39941 | Low | 3.7 | 2021-12-13 | An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the defa… |
CVE-2021-39940 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39939 | Medium | 6.5 | 2021-12-13 | An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 be… |
CVE-2021-39938 | Low | 3.1 | 2021-12-13 | A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting… |
CVE-2021-39937 | Medium | 5.9 | 2021-12-13 | A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting fro… |
CVE-2021-39936 | Low | 3.5 | 2021-12-13 | Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions st… |
CVE-2021-39935 | Medium | 6.8 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39934 | Medium | 4.3 | 2021-12-13 | Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all version… |
CVE-2021-39933 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versi… |
CVE-2021-39932 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39931 | Low | 3.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39930 | Medium | 4.3 | 2021-12-13 | Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a u… |
CVE-2021-39919 | Medium | 4.4 | 2021-12-13 | In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5… |
CVE-2021-39918 | Low | 3.1 | 2021-12-13 | Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions start… |
CVE-2021-39917 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39916 | Medium | 4.3 | 2021-12-13 | Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check… |
CVE-2021-39915 | Medium | 5.3 | 2021-12-13 | Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4… |
CVE-2021-39910 | Low | 2.6 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-22170 | Medium | 6.2 | 2021-12-06 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content |
CVE-2021-39913 | Medium | 4.4 | 2021-11-05 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, a… |
CVE-2021-39912 | Medium | 5.3 | 2021-11-05 | A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustio… |
CVE-2021-39911 | Low | 1.7 | 2021-11-05 | An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versio… |
CVE-2021-39909 | Medium | 5.3 | 2021-11-05 | Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting fro… |
CVE-2021-39907 | Medium | 5.3 | 2021-11-05 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU us… |
CVE-2021-39906 | High | 8.7 | 2021-11-05 | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. |
CVE-2021-39905 | Medium | 4.3 | 2021-11-05 | An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public proj… |
CVE-2021-39904 | Medium | 4.3 | 2021-11-05 | An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 b… |
CVE-2021-39901 | Low | 2.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. |
CVE-2021-39898 | Low | 3.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was… |
CVE-2021-39897 | Low | 2.6 | 2021-11-05 | Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have ac… |
CVE-2021-39895 | Medium | 6.0 | 2021-11-05 | In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner im… |
CVE-2021-22260 | High | 7.7 | 2021-11-05 | A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting… |
CVE-2021-39914 | Low | 3.1 | 2021-11-04 | A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a spe… |
CVE-2021-39903 | Medium | 6.5 | 2021-11-04 | In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restri… |
CVE-2021-39902 | Medium | 4.3 | 2021-11-04 | Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. |
CVE-2021-22263 | Medium | 5.5 | 2021-10-11 | An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-39880 | Medium | 6.5 | 2021-10-05 | A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting fro… |
CVE-2021-39891 | Medium | 5.9 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation… |
CVE-2021-39889 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to… |
CVE-2021-39886 | Low | 2.6 | 2021-10-05 | Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing u… |
CVE-2021-39881 | Low | 3.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which… |
CVE-2021-39870 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a… |
CVE-2021-22264 | Medium | 6.8 | 2021-10-05 | An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-22262 | Medium | 5.4 | 2021-10-05 | Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from… |
CVE-2021-22261 | High | 7.3 | 2021-10-05 | A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 be… |
CVE-2021-22258 | Medium | 4.3 | 2021-10-05 | The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses |
CVE-2021-22257 | Medium | 5.3 | 2021-10-05 | An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-39894 | Medium | 5.4 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Si… |
CVE-2021-39893 | Medium | 5.3 | 2021-10-05 | A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. |
CVE-2021-39888 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3… |
CVE-2021-39884 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are p… |
CVE-2021-39882 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. |
CVE-2021-39878 | Medium | 5.8 | 2021-10-05 | A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary java… |
CVE-2021-39875 | Medium | 5.3 | 2021-10-05 | In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visiting an API endpoint. |
CVE-2021-39872 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through… |
CVE-2021-39869 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project. |
CVE-2021-39867 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Requ… |
CVE-2021-39866 | Medium | 5.4 | 2021-10-05 | A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens. |
CVE-2021-39887 | High | 7.3 | 2021-10-05 | A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary Java… |
CVE-2021-39900 | Low | 2.0 | 2021-10-04 | Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availabi… |
CVE-2021-39899 | Low | 2.9 | 2021-10-04 | In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. The… |
CVE-2021-39896 | Low | 3.8 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the… |
CVE-2021-39885 | High | 8.7 | 2021-10-04 | A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and a… |
CVE-2021-39883 | Medium | 4.3 | 2021-10-04 | Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions s… |
CVE-2021-39879 | Low | 2.2 | 2021-10-04 | Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authenti… |
CVE-2021-39877 | High | 7.7 | 2021-10-04 | A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted… |
CVE-2021-39874 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. |
CVE-2021-39873 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious web… |
CVE-2021-39871 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker maki… |
CVE-2021-39868 | Medium | 4.3 | 2021-10-04 | In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modif… |
CVE-2021-22259 | Medium | 4.3 | 2021-10-04 | A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. |
CVE-2021-22239 | Medium | 5.0 | 2021-09-09 | An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. |
CVE-2021-22256 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status |
CVE-2021-22250 | Medium | 5.4 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for… |
CVE-2021-22247 | Medium | 4.3 | 2021-08-25 | Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics |
CVE-2021-22245 | Low | 2.7 | 2021-08-25 | Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view |
CVE-2021-22244 | Low | 3.1 | 2021-08-25 | Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data |