GitLab
Page 9 of 15 — GitLab CVEs from a corpus of 1484, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1406 | Medium | 6.5 | 2022-05-11 | Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Deve… |
CVE-2022-1352 | Medium | 5.3 | 2022-05-11 | Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prio… |
CVE-2022-1124 | Medium | 4.3 | 2022-05-11 | An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10… |
CVE-2022-1431 | Medium | 4.3 | 2022-05-10 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions st… |
CVE-2022-1417 | Medium | 4.3 | 2022-05-10 | Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all version… |
CVE-2022-0477 | Medium | 4.9 | 2022-04-25 | An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions s… |
CVE-2022-1193 | Medium | 4.3 | 2022-04-11 | Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain detail… |
CVE-2022-1157 | Low | 2.6 | 2022-04-11 | Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potent… |
CVE-2022-1190 | High | 8.7 | 2022-04-04 | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a s… |
CVE-2022-1189 | Low | 3.1 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1188 | Low | 3.7 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1185 | Medium | 6.5 | 2022-04-04 | A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to… |
CVE-2022-1175 | High | 8.7 | 2022-04-04 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14… |
CVE-2022-1174 | Medium | 4.3 | 2022-04-04 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting… |
CVE-2022-1162 | Critical | 9.1 | 2022-04-04 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 pr… |
CVE-2022-1148 | Medium | 5.3 | 2022-04-04 | Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14… |
CVE-2022-1121 | Medium | 5.3 | 2022-04-04 | A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-1120 | Medium | 4.8 | 2022-04-04 | Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive… |
CVE-2022-1111 | Low | 2.4 | 2022-04-04 | A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions… |
CVE-2022-1105 | Medium | 4.3 | 2022-04-04 | An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allo… |
CVE-2022-1100 | Medium | 4.3 | 2022-04-04 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9… |
CVE-2022-1099 | Medium | 4.3 | 2022-04-04 | Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-0740 | Low | 3.1 | 2022-04-04 | Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all ve… |
CVE-2022-0741 | Medium | 5.8 | 2022-04-01 | Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafte… |
CVE-2022-0489 | Low | 3.5 | 2022-04-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a spec… |
CVE-2022-0425 | Medium | 5.4 | 2022-04-01 | A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side… |
CVE-2022-0390 | Medium | 4.3 | 2022-04-01 | Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details w… |
CVE-2022-0373 | Medium | 4.3 | 2022-04-01 | Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk ema… |
CVE-2021-39908 | Medium | 6.5 | 2022-04-01 | In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14… |
CVE-2022-0751 | Medium | 6.5 | 2022-03-28 | Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content… |
CVE-2022-0738 | Medium | 4.2 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions sta… |
CVE-2022-0735 | Critical | 10.0 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versi… |
CVE-2022-0549 | Medium | 6.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14… |
CVE-2022-0488 | Low | 3.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by… |
CVE-2022-0427 | High | 7.7 | 2022-03-28 | Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP PO… |
CVE-2022-0371 | Medium | 4.3 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versio… |
CVE-2022-0344 | Low | 3.1 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions sta… |
CVE-2022-0283 | Medium | 4.7 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cau… |
CVE-2022-0249 | Low | 3.1 | 2022-03-28 | A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not… |
CVE-2022-0136 | Medium | 5.4 | 2022-03-28 | A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the… |
CVE-2022-0123 | Medium | 5.9 | 2022-03-28 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL… |
CVE-2021-4191 | Medium | 5.3 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted si… |
CVE-2021-39876 | Medium | 4.3 | 2022-03-28 | In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. |
CVE-2021-39943 | Medium | 4.3 | 2022-02-09 | An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from… |
CVE-2022-0244 | High | 8.6 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorr… |
CVE-2022-0172 | Medium | 5.3 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction f… |
CVE-2022-0154 | High | 7.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions st… |
CVE-2022-0152 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0151 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0125 | Medium | 4.3 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2022-0124 | Medium | 4.3 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is… |
CVE-2022-0093 | Low | 3.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an… |
CVE-2022-0090 | Medium | 6.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way… |
CVE-2021-39946 | High | 8.7 | 2022-01-18 | Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing… |
CVE-2021-39942 | Medium | 4.3 | 2022-01-18 | A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all v… |
CVE-2021-39927 | Low | 3.5 | 2022-01-18 | Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to… |
CVE-2021-39892 | Medium | 4.3 | 2022-01-18 | In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclo… |
CVE-2021-39945 | Low | 2.7 | 2021-12-13 | Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all vers… |
CVE-2021-39944 | High | 7.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39941 | Low | 3.7 | 2021-12-13 | An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the defa… |
CVE-2021-39940 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39939 | Medium | 6.5 | 2021-12-13 | An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 be… |
CVE-2021-39938 | Low | 3.1 | 2021-12-13 | A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting… |
CVE-2021-39937 | Medium | 5.9 | 2021-12-13 | A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting fro… |
CVE-2021-39936 | Low | 3.5 | 2021-12-13 | Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions st… |
CVE-2021-39935 | Medium | 6.8 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39934 | Medium | 4.3 | 2021-12-13 | Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all version… |
CVE-2021-39933 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versi… |
CVE-2021-39932 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39931 | Low | 3.1 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39930 | Medium | 4.3 | 2021-12-13 | Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a u… |
CVE-2021-39919 | Medium | 4.4 | 2021-12-13 | In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5… |
CVE-2021-39918 | Low | 3.1 | 2021-12-13 | Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions start… |
CVE-2021-39917 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39916 | Medium | 4.3 | 2021-12-13 | Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check… |
CVE-2021-39915 | Medium | 5.3 | 2021-12-13 | Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4… |
CVE-2021-39910 | Low | 2.6 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-22170 | Medium | 6.2 | 2021-12-06 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content |
CVE-2021-39913 | Medium | 4.4 | 2021-11-05 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, a… |
CVE-2021-39912 | Medium | 5.3 | 2021-11-05 | A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustio… |
CVE-2021-39911 | Low | 1.7 | 2021-11-05 | An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versio… |
CVE-2021-39909 | Medium | 5.3 | 2021-11-05 | Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all versions starting fro… |
CVE-2021-39907 | Medium | 5.3 | 2021-11-05 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU us… |
CVE-2021-39906 | High | 8.7 | 2021-11-05 | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. |
CVE-2021-39905 | Medium | 4.3 | 2021-11-05 | An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public proj… |
CVE-2021-39904 | Medium | 4.3 | 2021-11-05 | An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 b… |
CVE-2021-39901 | Low | 2.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. |
CVE-2021-39898 | Low | 3.7 | 2021-11-05 | In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was… |
CVE-2021-39897 | Low | 2.6 | 2021-11-05 | Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have ac… |
CVE-2021-39895 | Medium | 6.0 | 2021-11-05 | In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner im… |
CVE-2021-22260 | High | 7.7 | 2021-11-05 | A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all versions starting… |
CVE-2021-39914 | Low | 3.1 | 2021-11-04 | A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a spe… |
CVE-2021-39903 | Medium | 6.5 | 2021-11-04 | In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restri… |
CVE-2021-39902 | Medium | 4.3 | 2021-11-04 | Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. |
CVE-2021-22263 | Medium | 5.5 | 2021-10-11 | An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions sta… |
CVE-2021-39880 | Medium | 6.5 | 2021-10-05 | A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting fro… |
CVE-2021-39891 | Medium | 5.9 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation… |
CVE-2021-39889 | Medium | 4.3 | 2021-10-05 | In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to… |
CVE-2021-39886 | Low | 2.6 | 2021-10-05 | Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing u… |