English
Français
Light
Dark
System

Alert System

Stay informed at all times
Create an account Open a free account Login Manage your alerts

GitLab 11.0.0 Release Candidate 13 Community Edition

CPE Details

GitLab 11.0.0 Release Candidate 13 Community Edition
gitlab
gitlab
11.0.0
2019-03-04 13:10 +00:00
2019-03-04 13:10 +00:00
CPE NVD

Alerte pour un CPE

Stay informed of any changes for a specific CPE.
Alert management

CPE Name: cpe:2.3:a:gitlab:gitlab:11.0.0:rc13:*:*:community:*:*:*

Informations

Vendor

gitlab

Product

gitlab

Version

11.0.0

Update

rc13

Software Edition

community

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-1493 2024-06-26 23:31 +00:00 An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server
6.5
MEDIUM
CVE-2024-4557 2024-06-26 23:31 +00:00 Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline.
6.5
MEDIUM
CVE-2023-3509 2024-02-21 22:57 +00:00 An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.
5.4
MEDIUM
CVE-2023-5612 2024-01-26 02:02 +00:00 An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
5.3
MEDIUM
CVE-2023-5356 2024-01-12 13:56 +00:00 Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.
8.8
HIGH
CVE-2023-6955 2024-01-12 13:56 +00:00 An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
6.6
MEDIUM
CVE-2023-5061 2023-12-15 16:03 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API.
4.3
MEDIUM
CVE-2023-6051 2023-12-15 16:02 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag.
6.5
MEDIUM
CVE-2023-4317 2023-12-01 07:02 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.
4.3
MEDIUM
CVE-2023-5226 2023-12-01 07:01 +00:00 An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.
7.5
HIGH
CVE-2023-3246 2023-11-06 12:01 +00:00 An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor.
4.3
MEDIUM
CVE-2023-3922 2023-09-29 07:30 +00:00 An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.
7.1
HIGH
CVE-2023-5198 2023-09-29 07:01 +00:00 An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.
4.3
MEDIUM
CVE-2023-3917 2023-09-29 06:02 +00:00 Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.
7.5
HIGH
CVE-2023-3979 2023-09-29 06:02 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.
4.3
MEDIUM
CVE-2023-4630 2023-09-11 13:01 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports.
5
MEDIUM
CVE-2023-0120 2023-09-01 10:01 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.
4.3
MEDIUM
CVE-2023-1279 2023-09-01 10:01 +00:00 An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.
6.1
MEDIUM
CVE-2023-4522 2023-08-30 07:01 +00:00 An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
5.3
MEDIUM
CVE-2023-2022 2023-08-02 08:30 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge
4.3
MEDIUM
CVE-2023-3401 2023-08-02 08:30 +00:00 An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
6.5
MEDIUM
CVE-2023-3500 2023-08-02 00:07 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
6.1
MEDIUM
CVE-2023-3994 2023-08-02 00:06 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
7.5
HIGH
CVE-2023-3364 2023-08-01 23:36 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
7.5
HIGH
CVE-2023-3385 2023-08-01 23:35 +00:00 An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
6.5
MEDIUM
CVE-2023-3424 2023-07-13 02:08 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
7.5
HIGH
CVE-2023-2200 2023-07-13 02:02 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.
5.4
MEDIUM
CVE-2023-2001 2023-06-06 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.
4.3
MEDIUM
CVE-2023-2013 2023-06-06 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
4.3
MEDIUM
CVE-2023-2198 2023-06-06 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
7.5
HIGH
CVE-2023-0921 2023-06-05 22:00 +00:00 A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
4.3
MEDIUM
CVE-2023-2181 2023-05-11 22:00 +00:00 An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.
6.5
MEDIUM
CVE-2022-4376 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.
4.3
MEDIUM
CVE-2023-0155 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
5.4
MEDIUM
CVE-2023-0756 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.
8
HIGH
CVE-2023-1178 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
5.7
MEDIUM
CVE-2023-1204 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.
4.3
MEDIUM
CVE-2023-1836 2023-05-02 22:00 +00:00 A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances
5.4
MEDIUM
CVE-2023-2069 2023-05-02 22:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.
6.4
MEDIUM
CVE-2018-15472 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.
7.5
HIGH
CVE-2018-17449 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.
7.5
HIGH
CVE-2018-17450 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.
4.3
MEDIUM
CVE-2018-17451 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.
8.8
HIGH
CVE-2018-17452 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
9.8
CRITICAL
CVE-2018-17453 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.
5.3
MEDIUM
CVE-2018-17454 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.
5.4
MEDIUM
CVE-2018-17455 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
7.5
HIGH
CVE-2018-17536 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.
5.4
MEDIUM
CVE-2018-17537 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .
5.4
MEDIUM
CVE-2019-14942 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.
5.9
MEDIUM
CVE-2019-14944 2023-04-14 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.
6.5
MEDIUM
CVE-2023-0450 2023-04-04 22:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.
4.6
MEDIUM
CVE-2023-1708 2023-04-04 22:00 +00:00 An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
9.8
CRITICAL
CVE-2022-3381 2023-03-08 23:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites
6.1
MEDIUM
CVE-2023-1072 2023-03-08 23:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
5.3
MEDIUM
CVE-2023-1084 2023-03-08 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
2.7
LOW
CVE-2022-4138 2023-02-12 23:00 +00:00 A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
8.1
HIGH
CVE-2022-4205 2023-01-26 23:00 +00:00 In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
7.5
HIGH
CVE-2022-3902 2023-01-23 23:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.
6.4
MEDIUM
CVE-2022-4054 2023-01-23 23:00 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
5.5
MEDIUM
CVE-2022-3514 2023-01-11 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
5.3
MEDIUM
CVE-2022-3613 2023-01-11 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
7.5
HIGH
CVE-2022-3870 2023-01-11 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
5.3
MEDIUM
CVE-2022-4037 2023-01-11 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.
8.5
HIGH
CVE-2022-4131 2023-01-11 23:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
5.3
MEDIUM
CVE-2022-3265 2022-11-08 23:00 +00:00 A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
7.3
HIGH
CVE-2022-3280 2022-11-08 23:00 +00:00 An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.
6.1
MEDIUM
CVE-2022-3486 2022-11-08 23:00 +00:00 An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL.
6.1
MEDIUM
CVE-2022-3706 2022-11-08 23:00 +00:00 Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project.
4.3
MEDIUM
CVE-2022-3818 2022-11-08 23:00 +00:00 An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.
5.3
MEDIUM
CVE-2022-3018 2022-10-27 22:00 +00:00 An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs.
6.8
MEDIUM
CVE-2022-3639 2022-10-20 22:00 +00:00 A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage.
7.5
HIGH
CVE-2022-2428 2022-10-16 22:00 +00:00 A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests
7.3
HIGH
CVE-2022-2455 2022-10-16 22:00 +00:00 A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.
6.5
MEDIUM
CVE-2022-2592 2022-10-16 22:00 +00:00 A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.
6.5
MEDIUM
CVE-2022-2865 2022-10-16 22:00 +00:00 A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
7.3
HIGH
CVE-2022-2908 2022-10-16 22:00 +00:00 A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.
4.3
MEDIUM
CVE-2022-2931 2022-10-16 22:00 +00:00 A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.
7.5
HIGH
CVE-2022-3030 2022-10-16 22:00 +00:00 An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users.
4.3
MEDIUM
CVE-2022-3031 2022-10-16 22:00 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.
7.5
HIGH
CVE-2022-3060 2022-10-16 22:00 +00:00 Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests
7.3
HIGH
CVE-2022-3279 2022-10-16 22:00 +00:00 An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs
6.5
MEDIUM
CVE-2022-3283 2022-10-16 22:00 +00:00 A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.
7.5
HIGH
CVE-2022-3288 2022-10-16 22:00 +00:00 A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.
4.3
MEDIUM
CVE-2022-2459 2022-08-05 13:12 +00:00 An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.
2.7
LOW
CVE-2022-2500 2022-08-05 13:12 +00:00 A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.
5.4
MEDIUM
CVE-2022-2534 2022-08-05 13:11 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.
5.3
MEDIUM
CVE-2022-2303 2022-08-05 13:11 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.
4.3
MEDIUM
CVE-2022-2326 2022-08-05 13:11 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.
8.1
HIGH
CVE-2022-2456 2022-08-05 13:10 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
4.9
MEDIUM
CVE-2022-1954 2022-07-01 15:01 +00:00 A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers
5.3
MEDIUM
CVE-2022-1999 2022-07-01 14:06 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.
5.3
MEDIUM
CVE-2022-2227 2022-07-01 13:53 +00:00 Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions
4.3
MEDIUM
CVE-2022-1821 2022-06-06 14:56 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group.
4.3
MEDIUM
CVE-2022-1423 2022-05-19 15:12 +00:00 Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches
8.8
HIGH
CVE-2022-1413 2022-05-19 15:11 +00:00 Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface
7.5
HIGH
CVE-2022-1416 2022-05-19 15:10 +00:00 Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
5.4
MEDIUM
CVE-2022-1124 2022-05-11 12:50 +00:00 An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled
4.3
MEDIUM
CVE-2022-1460 2022-05-11 12:45 +00:00 An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.
6.1
MEDIUM
CVE-2022-1406 2022-05-11 12:42 +00:00 Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project
6.5
MEDIUM
CVE-2022-1428 2022-05-11 12:40 +00:00 An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced.
4.3
MEDIUM
CVE-2022-1352 2022-05-11 12:30 +00:00 Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.
5.3
MEDIUM
CVE-2022-1417 2022-05-10 18:30 +00:00 Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs
4.3
MEDIUM
CVE-2022-1157 2022-04-11 17:38 +00:00 Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged
2.6
LOW
CVE-2022-1193 2022-04-11 17:38 +00:00 Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances
4.3
MEDIUM
CVE-2022-1190 2022-04-04 17:46 +00:00 Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
8.7
HIGH
CVE-2022-1121 2022-04-04 17:46 +00:00 A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption.
5.3
MEDIUM
CVE-2022-1185 2022-04-04 17:46 +00:00 A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file
6.5
MEDIUM
CVE-2022-1120 2022-04-04 17:46 +00:00 Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.
6.5
MEDIUM
CVE-2022-1099 2022-04-04 17:46 +00:00 Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab
4.3
MEDIUM
CVE-2022-0740 2022-04-04 17:45 +00:00 Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.
4.3
MEDIUM
CVE-2022-0741 2022-04-01 20:17 +00:00 Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.
7.5
HIGH
CVE-2022-0425 2022-04-01 20:17 +00:00 A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.
7.6
HIGH
CVE-2021-39908 2022-04-01 20:17 +00:00 In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI.
7.5
HIGH
CVE-2022-0489 2022-04-01 20:17 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.
5.7
MEDIUM
CVE-2022-0136 2022-03-28 16:53 +00:00 A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
8.1
HIGH
CVE-2022-0488 2022-03-28 16:53 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.
4.3
MEDIUM
CVE-2022-0344 2022-03-28 16:53 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
4.3
MEDIUM
CVE-2022-0123 2022-03-28 16:53 +00:00 An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
6.8
MEDIUM
CVE-2022-0738 2022-03-28 16:53 +00:00 An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.
7.5
HIGH
CVE-2022-0751 2022-03-28 16:53 +00:00 Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands
8.8
HIGH
CVE-2022-0090 2022-01-18 15:52 +00:00 An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.
6.5
MEDIUM
CVE-2022-0093 2022-01-18 15:52 +00:00 An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds.
4.3
MEDIUM
CVE-2022-0154 2022-01-18 15:52 +00:00 An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.
8
HIGH
CVE-2022-0124 2022-01-18 15:52 +00:00 An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.
4.3
MEDIUM
CVE-2021-39927 2022-01-18 15:51 +00:00 Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443
4.3
MEDIUM
CVE-2021-39935 2021-12-13 14:47 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
7.5
HIGH
CVE-2021-39932 2021-12-13 14:47 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes.
4.3
MEDIUM
CVE-2021-39938 2021-12-13 14:47 +00:00 A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands
6.5
MEDIUM
CVE-2021-39937 2021-12-13 14:47 +00:00 A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances
8.8
HIGH
CVE-2021-39931 2021-12-13 14:47 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error.
4.3
MEDIUM
CVE-2021-39936 2021-12-13 14:47 +00:00 Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project's disabled wiki.
4.3
MEDIUM
CVE-2021-39945 2021-12-13 14:47 +00:00 Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked
2.7
LOW
CVE-2021-39944 2021-12-13 14:47 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import
7.1
HIGH
CVE-2021-39898 2021-11-04 22:21 +00:00 In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
5.3
MEDIUM
CVE-2021-39905 2021-11-04 22:17 +00:00 An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with
4.3
MEDIUM
CVE-2021-39895 2021-11-04 22:11 +00:00 In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source.
6
MEDIUM
CVE-2021-39913 2021-11-04 22:08 +00:00 Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges
6.7
MEDIUM
CVE-2021-39914 2021-11-04 21:39 +00:00 A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user
4.3
MEDIUM
CVE-2021-22258 2021-10-05 11:49 +00:00 The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
4.3
MEDIUM
CVE-2021-39881 2021-10-05 11:40 +00:00 In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
3.5
LOW
CVE-2021-39886 2021-10-05 11:39 +00:00 Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
4.3
MEDIUM
CVE-2021-39891 2021-10-05 11:38 +00:00 In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
5.9
MEDIUM
CVE-2021-39894 2021-10-05 10:33 +00:00 In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
5.4
MEDIUM
CVE-2021-39869 2021-10-05 10:30 +00:00 In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
6.5
MEDIUM
CVE-2021-39867 2021-10-05 10:29 +00:00 In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.
8.1
HIGH
CVE-2021-39884 2021-10-05 10:27 +00:00 In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project.
4.3
MEDIUM
CVE-2021-39882 2021-10-05 10:22 +00:00 In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.
5.3
MEDIUM
CVE-2021-39893 2021-10-05 10:18 +00:00 A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.
7.5
HIGH
CVE-2021-39887 2021-10-05 09:12 +00:00 A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.
7.3
HIGH
CVE-2021-39868 2021-10-04 14:55 +00:00 In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.
4.3
MEDIUM
CVE-2021-39874 2021-10-04 14:50 +00:00 In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.
4.3
MEDIUM
CVE-2021-39899 2021-10-04 14:47 +00:00 In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.
4.2
MEDIUM
CVE-2021-39900 2021-10-04 14:45 +00:00 Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.
2.7
LOW
CVE-2021-39896 2021-10-04 14:44 +00:00 In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues.
3.8
LOW
CVE-2021-39873 2021-10-04 14:43 +00:00 In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.
4.3
MEDIUM
CVE-2021-39879 2021-10-04 14:42 +00:00 Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication
3.5
LOW
CVE-2021-22243 2021-08-25 16:36 +00:00 Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
5
MEDIUM
CVE-2021-22245 2021-08-25 16:31 +00:00 Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view
2.7
LOW
CVE-2021-22246 2021-08-20 15:38 +00:00 A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks.
7.7
HIGH
CVE-2021-22230 2021-07-07 08:47 +00:00 Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2.
7.2
HIGH
CVE-2021-22231 2021-07-07 08:28 +00:00 A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username.
4.3
MEDIUM
CVE-2021-22228 2021-07-06 19:34 +00:00 An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql.
6.5
MEDIUM
CVE-2021-22232 2021-07-06 18:43 +00:00 HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
5.4
MEDIUM
CVE-2021-22175 2021-06-11 13:30 +00:00 When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
9.8
CRITICAL
CVE-2021-22216 2021-06-08 17:19 +00:00 A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description
6.5
MEDIUM
CVE-2021-22219 2021-06-08 16:38 +00:00 All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.
4.9
MEDIUM
CVE-2021-22217 2021-06-08 16:25 +00:00 A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request
6.5
MEDIUM
CVE-2021-22213 2021-06-08 16:03 +00:00 A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari
8.8
HIGH
CVE-2021-22214 2021-06-08 12:59 +00:00 When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
8.6
HIGH
CVE-2021-22202 2021-04-02 14:25 +00:00 An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.
4.3
MEDIUM
CVE-2021-22197 2021-04-02 14:21 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other
4.3
MEDIUM
CVE-2021-22194 2021-03-26 18:08 +00:00 In all versions of GitLab, marshalled session keys were being stored in Redis.
5.7
MEDIUM
CVE-2021-22193 2021-03-24 15:57 +00:00 An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.
3.5
LOW
CVE-2021-22176 2021-03-24 15:46 +00:00 An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests
4.3
MEDIUM
CVE-2021-22186 2021-03-24 15:42 +00:00 An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners
4.9
MEDIUM
CVE-2021-22189 2021-03-04 13:54 +00:00 Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.
7.2
HIGH
CVE-2021-22187 2021-03-02 17:15 +00:00 An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.
4.3
MEDIUM
CVE-2020-26416 2020-12-11 02:34 +00:00 Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
4.4
MEDIUM
CVE-2020-26409 2020-12-11 00:17 +00:00 A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.
6.5
MEDIUM
CVE-2020-13356 2020-11-18 22:35 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
8.2
HIGH
CVE-2020-13355 2020-11-18 22:30 +00:00 An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
8.1
HIGH
CVE-2020-13350 2020-11-17 16:55 +00:00 CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.
4.3
MEDIUM
CVE-2020-13352 2020-11-16 23:36 +00:00 Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
5.3
MEDIUM
CVE-2020-13339 2020-10-08 11:51 +00:00 An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.
6.5
MEDIUM
CVE-2020-13340 2020-10-08 11:46 +00:00 An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
8.7
HIGH
CVE-2020-13344 2020-10-08 11:43 +00:00 An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
5.7
MEDIUM
CVE-2020-13342 2020-10-07 13:57 +00:00 An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email
2.7
LOW
CVE-2020-13334 2020-10-07 11:18 +00:00 In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query
7.5
HIGH
CVE-2020-13335 2020-10-07 11:03 +00:00 Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.
4.3
MEDIUM
CVE-2020-13345 2020-10-06 16:26 +00:00 An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
5.5
MEDIUM
CVE-2020-13338 2020-10-02 17:20 +00:00 An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.
5.4
MEDIUM
CVE-2020-13321 2020-09-29 16:40 +00:00 A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.
8.3
HIGH
CVE-2020-13324 2020-09-29 16:36 +00:00 A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API.
6.5
MEDIUM
CVE-2020-13323 2020-09-29 16:29 +00:00 A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos
7.7
HIGH
CVE-2020-13331 2020-09-29 15:47 +00:00 An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.
5.4
MEDIUM
CVE-2020-13330 2020-09-29 15:41 +00:00 An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.
5.4
MEDIUM
CVE-2020-13329 2020-09-29 14:11 +00:00 An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.
6.5
MEDIUM
CVE-2020-13320 2020-09-29 14:07 +00:00 An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
6.5
MEDIUM
CVE-2020-13319 2020-09-29 13:58 +00:00 An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.
4.3
MEDIUM
CVE-2020-13298 2020-09-14 19:44 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.
7.2
HIGH
CVE-2020-13305 2020-09-14 19:42 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.
4.3
MEDIUM
CVE-2020-13309 2020-09-14 19:36 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.
8.8
HIGH
CVE-2020-13310 2020-09-14 19:33 +00:00 A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.
6.5
MEDIUM
CVE-2020-13315 2020-09-14 19:32 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.
7.5
HIGH
CVE-2020-13306 2020-09-14 19:28 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.
7.5
HIGH
CVE-2020-13301 2020-09-14 19:26 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.
5.5
MEDIUM
CVE-2020-13302 2020-09-14 19:23 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.
7.2
HIGH
CVE-2020-13297 2020-09-14 19:22 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.
5.4
MEDIUM
CVE-2020-13304 2020-09-14 19:19 +00:00 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.
7.2
HIGH
CVE-2020-13281 2020-08-13 11:22 +00:00 For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
6.5
MEDIUM
CVE-2020-13280 2020-08-13 10:49 +00:00 For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.
6.5
MEDIUM
CVE-2020-13283 2020-08-13 10:38 +00:00 For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.
7.3
HIGH
CVE-2020-13282 2020-08-13 10:33 +00:00 For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.
3.5
LOW
CVE-2020-13290 2020-08-12 12:24 +00:00 In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page
7.5
HIGH
CVE-2020-13294 2020-08-10 11:30 +00:00 In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
5.4
MEDIUM
CVE-2020-13293 2020-08-10 11:28 +00:00 In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
7.1
HIGH
CVE-2020-13263 2020-06-19 20:15 +00:00 An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.
8.8
HIGH
CVE-2020-13264 2020-06-19 20:13 +00:00 Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
5.3
MEDIUM
CVE-2020-13274 2020-06-19 19:53 +00:00 A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1
7.5
HIGH
CVE-2020-13276 2020-06-19 19:37 +00:00 User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
7.4
HIGH
CVE-2020-13277 2020-06-19 15:20 +00:00 An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
6.5
MEDIUM
CVE-2020-14155 2020-06-14 22:00 +00:00 libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
5.3
MEDIUM
CVE-2020-13271 2020-06-10 12:25 +00:00 A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
6.1
MEDIUM
CVE-2020-12276 2020-04-29 14:28 +00:00 GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
4.8
MEDIUM
CVE-2020-12277 2020-04-29 14:28 +00:00 GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.
5.3
MEDIUM
CVE-2020-11649 2020-04-22 17:52 +00:00 An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.
6.5
MEDIUM
CVE-2020-11506 2020-04-22 17:50 +00:00 An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling.
7.5
HIGH
CVE-2020-11505 2020-04-22 17:46 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.
7.5
HIGH
CVE-2020-10975 2020-04-08 16:11 +00:00 GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
4.3
MEDIUM
CVE-2020-10976 2020-04-08 16:10 +00:00 GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
7.5
HIGH
CVE-2020-10977 2020-04-08 16:09 +00:00 GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
5.5
MEDIUM
CVE-2020-10978 2020-04-08 16:08 +00:00 GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
5.3
MEDIUM
CVE-2020-10980 2020-04-08 16:05 +00:00 GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
9.8
CRITICAL
CVE-2020-10981 2020-04-08 16:04 +00:00 GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.
4.3
MEDIUM
CVE-2020-10952 2020-03-27 17:55 +00:00 GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
6.5
MEDIUM
CVE-2020-10954 2020-03-27 17:50 +00:00 GitLab through 12.9 is affected by a potential DoS in repository archive download.
7.5
HIGH
CVE-2020-10956 2020-03-27 17:25 +00:00 GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
9.8
CRITICAL
CVE-2020-10074 2020-03-13 16:13 +00:00 GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.
9.8
CRITICAL
CVE-2020-10079 2020-03-13 15:57 +00:00 GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required.
5.3
MEDIUM
CVE-2020-10080 2020-03-13 15:56 +00:00 GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.
5.3
MEDIUM
CVE-2020-10081 2020-03-13 15:54 +00:00 GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user.
6.5
MEDIUM
CVE-2020-10086 2020-03-13 15:40 +00:00 GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.
5.3
MEDIUM
CVE-2020-10087 2020-03-13 15:34 +00:00 GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.
7.5
HIGH
CVE-2020-10089 2020-03-13 15:27 +00:00 GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
7.5
HIGH
CVE-2020-10091 2020-03-13 15:18 +00:00 GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.
6.1
MEDIUM
CVE-2019-13009 2020-03-10 16:06 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
6.5
MEDIUM
CVE-2019-13006 2020-03-10 15:57 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.
4.3
MEDIUM
CVE-2019-13003 2020-03-10 13:53 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
7.5
HIGH
CVE-2019-12446 2020-03-10 13:47 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
7.5
HIGH
CVE-2019-12445 2020-03-10 13:45 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.
5.4
MEDIUM
CVE-2019-12444 2020-03-10 13:42 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
6.1
MEDIUM
CVE-2019-12441 2020-03-10 13:36 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.
7.5
HIGH
CVE-2019-12434 2020-03-10 12:48 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure.
4.3
MEDIUM
CVE-2019-12432 2020-03-10 12:43 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure.
4.3
MEDIUM
CVE-2019-12431 2020-03-10 12:41 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control.
4.3
MEDIUM
CVE-2019-12428 2020-03-10 12:08 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization.
9.8
CRITICAL
CVE-2020-8113 2020-03-06 16:20 +00:00 GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
9.8
CRITICAL
CVE-2020-7968 2020-02-05 14:56 +00:00 GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
7.5
HIGH
CVE-2020-7973 2020-02-05 14:52 +00:00 GitLab through 12.7.2 allows XSS.
6.1
MEDIUM
CVE-2019-5470 2020-01-28 01:49 +00:00 An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.
7.5
HIGH
CVE-2019-5465 2020-01-28 01:28 +00:00 An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.
4.3
MEDIUM
CVE-2019-5464 2020-01-28 01:23 +00:00 A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.
9.8
CRITICAL
CVE-2019-5462 2020-01-28 01:17 +00:00 A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.
8.8
HIGH
CVE-2019-20144 2020-01-13 19:01 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.
4.3
MEDIUM
CVE-2019-20146 2020-01-13 18:59 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.
5.3
MEDIUM
CVE-2019-20147 2020-01-13 18:56 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.
5.3
MEDIUM
CVE-2019-20148 2020-01-13 18:52 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.
5.3
MEDIUM
CVE-2020-5197 2020-01-13 18:51 +00:00 An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.
4.3
MEDIUM
CVE-2020-6832 2020-01-13 18:47 +00:00 An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects.
5.3
MEDIUM
CVE-2019-19260 2020-01-03 15:32 +00:00 GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).
5.4
MEDIUM
CVE-2019-19257 2020-01-03 15:26 +00:00 GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).
5.3
MEDIUM
CVE-2019-19254 2020-01-03 14:51 +00:00 GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.
5.3
MEDIUM
CVE-2018-20488 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
4.3
MEDIUM
CVE-2018-20489 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
5.3
MEDIUM
CVE-2018-20493 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
4.3
MEDIUM
CVE-2018-20494 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
7.5
HIGH
CVE-2018-20496 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.
5.4
MEDIUM
CVE-2018-20497 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
5
MEDIUM
CVE-2018-20498 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
4.3
MEDIUM
CVE-2018-20499 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
7.2
HIGH
CVE-2018-20501 2019-12-30 20:24 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
6.3
MEDIUM
CVE-2018-20492 2019-12-26 15:44 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).
5.3
MEDIUM
CVE-2019-15584 2019-12-20 20:02 +00:00 A denial of service exists in gitlab
6.5
MEDIUM
CVE-2019-15589 2019-12-18 20:00 +00:00 An improper access control vulnerability exists in Gitlab
8.8
HIGH
CVE-2019-15575 2019-12-18 20:00 +00:00 A command injection exists in GitLab CE/EE
7.5
HIGH
CVE-2019-15576 2019-12-18 20:00 +00:00 An information disclosure vulnerability exists in GitLab CE/EE
7.5
HIGH
CVE-2019-15577 2019-12-18 20:00 +00:00 An information disclosure vulnerability exists in GitLab CE/EE
4.3
MEDIUM
CVE-2019-15580 2019-12-18 19:59 +00:00 An information exposure vulnerability exists in gitlab.com
6.5
MEDIUM
CVE-2019-5486 2019-12-18 19:58 +00:00 A authentication bypass vulnerability exists in GitLab CE/EE
8.8
HIGH
CVE-2019-15591 2019-12-18 19:51 +00:00 An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
6.5
MEDIUM
CVE-2019-18446 2019-11-26 15:50 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).
4.3
MEDIUM
CVE-2019-18447 2019-11-26 15:49 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.
4.3
MEDIUM
CVE-2019-18448 2019-11-26 15:48 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.
6.5
MEDIUM
CVE-2019-18449 2019-11-26 15:47 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).
4.3
MEDIUM
CVE-2019-18450 2019-11-26 15:44 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.
4.3
MEDIUM
CVE-2019-18451 2019-11-26 15:43 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.
6.1
MEDIUM
CVE-2019-18454 2019-11-26 15:31 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.
6.1
MEDIUM
CVE-2019-18455 2019-11-26 15:26 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.
7.5
HIGH
CVE-2019-18456 2019-11-26 15:04 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).
5.3
MEDIUM
CVE-2019-18458 2019-11-26 14:40 +00:00 An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4).
2.7
LOW
CVE-2019-18460 2019-11-26 13:47 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.
7.5
HIGH
CVE-2019-18463 2019-11-26 13:39 +00:00 An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).
4.3
MEDIUM
CVE-2019-15729 2019-09-17 12:34 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
7.5
HIGH
CVE-2019-15740 2019-09-16 15:05 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.
5.3
MEDIUM
CVE-2019-15739 2019-09-16 15:04 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
6.1
MEDIUM
CVE-2019-15737 2019-09-16 15:02 +00:00 An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.
6.5
MEDIUM
CVE-2019-15736 2019-09-16 15:02 +00:00 An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.
7.5
HIGH
CVE-2019-15734 2019-09-16 15:01 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.
4.3
MEDIUM
CVE-2019-15733 2019-09-16 15:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.
4.3
MEDIUM
CVE-2019-15730 2019-09-16 14:57 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server.
7.5
HIGH
CVE-2019-15728 2019-09-16 14:54 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.
7.5
HIGH
CVE-2019-15726 2019-09-16 14:51 +00:00 An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.
5.3
MEDIUM
CVE-2019-15722 2019-09-16 14:45 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.
7.5
HIGH
CVE-2019-15721 2019-09-16 14:43 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings.
5.4
MEDIUM
CVE-2019-6791 2019-09-09 18:25 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility.
6.5
MEDIUM
CVE-2019-7176 2019-09-09 18:02 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
3.7
LOW
CVE-2019-6997 2019-09-09 17:57 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles.
4.3
MEDIUM
CVE-2019-6996 2019-09-09 17:56 +00:00 An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.
4.3
MEDIUM
CVE-2019-6995 2019-09-09 17:54 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.
6.5
MEDIUM
CVE-2019-6960 2019-09-09 17:52 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
9.8
CRITICAL
CVE-2019-6795 2019-09-09 17:43 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering.
5.4
MEDIUM
CVE-2019-6794 2019-09-09 17:41 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 5 of 6). A project guest user can view the last commit status of the default branch.
4.3
MEDIUM
CVE-2019-6792 2019-09-09 17:37 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.
5.3
MEDIUM
CVE-2019-6789 2019-09-09 17:32 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 4 of 6). In some cases, users without project permissions will receive emails after a project move. For private projects, this will disclose the new project namespace to an unauthorized user.
4.3
MEDIUM
CVE-2019-6788 2019-09-09 17:30 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 3 of 6). For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.
7.5
HIGH
CVE-2019-6786 2019-09-09 17:28 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known.
6.5
MEDIUM
CVE-2019-6785 2019-09-09 17:26 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service.
6.5
MEDIUM
CVE-2019-6784 2019-09-09 17:21 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.
6.1
MEDIUM
CVE-2019-6783 2019-09-09 17:19 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.
8.8
HIGH
CVE-2019-11549 2019-09-09 16:54 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.
6.5
MEDIUM
CVE-2019-11548 2019-09-09 16:52 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.
5.4
MEDIUM
CVE-2019-11547 2019-09-09 16:49 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.
6.1
MEDIUM
CVE-2019-11546 2019-09-09 16:34 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.
5.3
MEDIUM
CVE-2019-11544 2019-09-09 16:28 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.
4.3
MEDIUM
CVE-2018-19583 2019-07-10 14:43 +00:00 GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
6.5
MEDIUM
CVE-2018-19580 2019-07-10 14:04 +00:00 All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
5.3
MEDIUM
CVE-2018-19571 2019-07-10 14:01 +00:00 GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.
7.7
HIGH
CVE-2018-19574 2019-07-10 13:59 +00:00 GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page.
5.4
MEDIUM
CVE-2018-19569 2019-07-10 13:56 +00:00 GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope.
8.8
HIGH
CVE-2018-19575 2019-07-10 13:52 +00:00 GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue.
4.3
MEDIUM
CVE-2018-19576 2019-07-10 13:35 +00:00 GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.
8.1
HIGH
CVE-2018-19572 2019-07-10 13:32 +00:00 GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.
5.9
MEDIUM
CVE-2018-19573 2019-07-10 13:01 +00:00 GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid.
5.4
MEDIUM
CVE-2018-19577 2019-07-10 12:59 +00:00 Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue.
5.3
MEDIUM
CVE-2018-19496 2019-07-10 12:50 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.
6.5
MEDIUM
CVE-2018-19495 2019-07-10 12:48 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration.
6.5
MEDIUM
CVE-2018-19494 2019-07-10 12:46 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names.
4.3
MEDIUM
CVE-2018-19493 2019-07-10 12:44 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.
6.1
MEDIUM
CVE-2019-9866 2019-05-29 14:28 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure.
6.5
MEDIUM
CVE-2019-9732 2019-05-29 14:18 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
9.8
CRITICAL
CVE-2019-9485 2019-05-29 14:08 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
9.8
CRITICAL
CVE-2019-9221 2019-05-29 14:06 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 3 of 5).
5.5
MEDIUM
CVE-2019-9218 2019-05-29 13:59 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).
9.8
CRITICAL
CVE-2019-7549 2019-05-29 13:42 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.
4.3
MEDIUM
CVE-2019-6790 2019-05-17 13:53 +00:00 An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests.
4.3
MEDIUM
CVE-2019-6787 2019-05-17 13:49 +00:00 An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users.
6.5
MEDIUM
CVE-2019-6781 2019-05-17 13:42 +00:00 An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.
7.5
HIGH
CVE-2019-5883 2019-05-17 13:30 +00:00 An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.
9.1
CRITICAL
CVE-2018-20500 2019-05-17 13:18 +00:00 An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.
7.5
HIGH
CVE-2018-19585 2019-05-17 13:09 +00:00 GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.
7.5
HIGH
CVE-2019-10112 2019-05-16 13:11 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.
7.5
HIGH
CVE-2019-10117 2019-05-16 13:00 +00:00 An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node.
6.1
MEDIUM
CVE-2019-10116 2019-05-16 12:55 +00:00 An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue.
4.3
MEDIUM
CVE-2019-10115 2019-05-16 12:46 +00:00 An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.
6.5
MEDIUM
CVE-2019-10114 2019-05-16 12:39 +00:00 An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.
7.5
HIGH
CVE-2019-10113 2019-05-16 12:27 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects//languages requests may allow Uncontrolled Resource Consumption.
7.5
HIGH
CVE-2019-10111 2019-05-15 17:28 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.
5.4
MEDIUM
CVE-2019-10110 2019-05-15 17:23 +00:00 An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials.
6.5
MEDIUM
CVE-2019-10109 2019-05-15 17:14 +00:00 An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).
5.3
MEDIUM
CVE-2019-10108 2019-05-15 17:06 +00:00 An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.
5.4
MEDIUM
CVE-2019-10640 2019-05-15 16:58 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.
7.5
HIGH
CVE-2018-18643 2019-04-25 18:17 +00:00 GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.
6.1
MEDIUM
CVE-2019-9220 2019-04-17 14:52 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption.
7.5
HIGH
CVE-2019-9223 2019-04-17 14:50 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.
7.5
HIGH
CVE-2019-9222 2019-04-17 14:48 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
8.1
HIGH
CVE-2019-9217 2019-04-17 14:46 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information.
9.8
CRITICAL
CVE-2019-9219 2019-04-17 14:43 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).
3.7
LOW
CVE-2019-9225 2019-04-17 14:41 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 5 of 5).
5.3
MEDIUM
CVE-2019-9224 2019-04-17 14:39 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).
5.3
MEDIUM
CVE-2019-9171 2019-04-17 14:37 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5).
3.7
LOW
CVE-2019-9890 2019-04-17 14:34 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
9.1
CRITICAL
CVE-2019-9179 2019-04-17 14:31 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5).
3.7
LOW
CVE-2019-9178 2019-04-17 14:28 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 4 of 5).
5.3
MEDIUM
CVE-2019-9175 2019-04-17 14:26 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 3 of 5).
5.3
MEDIUM
CVE-2019-9170 2019-04-17 14:23 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.
5.3
MEDIUM
CVE-2019-9172 2019-04-17 14:20 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5).
5.9
MEDIUM
CVE-2019-9174 2019-04-17 14:17 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.
10
CRITICAL
CVE-2019-9176 2019-04-17 14:15 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF.
6.5
MEDIUM
CVE-2019-9756 2019-04-17 14:11 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.
9.8
CRITICAL
CVE-2019-7155 2019-04-16 19:47 +00:00 An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.
6.5
MEDIUM
CVE-2019-6796 2019-04-11 17:51 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.
6.1
MEDIUM
CVE-2018-20229 2019-04-04 14:54 +00:00 GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.
7.5
HIGH
CVE-2018-20144 2019-03-28 13:53 +00:00 GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
7.5
HIGH
CVE-2018-19856 2019-03-26 14:50 +00:00 GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.
7.5
HIGH
CVE-2019-6240 2019-03-25 15:45 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.
7.5
HIGH
CVE-2018-17975 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the GFM markdown API.
5.3
MEDIUM
CVE-2018-17976 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic change descriptions.
6.5
MEDIUM
CVE-2018-18640 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure Through Browser Caching.
6.5
MEDIUM
CVE-2018-18641 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of Sensitive Information.
9.8
CRITICAL
CVE-2018-18642 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS.
6.1
MEDIUM
CVE-2018-18645 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.
4.3
MEDIUM
CVE-2018-18646 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.
8.8
HIGH
CVE-2018-18647 2018-12-04 22:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization.
6.5
MEDIUM
CVE-2018-16049 2018-10-03 14:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message.
9.8
CRITICAL
CVE-2018-16051 2018-10-03 14:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure.
6.5
MEDIUM
CVE-2018-12606 2018-08-03 16:00 +00:00 An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.
5.4
MEDIUM
CVE-2018-12607 2018-08-03 16:00 +00:00 An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.
5.4
MEDIUM
CVE-2018-14602 2018-07-27 00:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. Information Disclosure can occur because the Prometheus metrics feature discloses private project pathnames.
7.5
HIGH
CVE-2018-14603 2018-07-27 00:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. CSRF can occur in the Test feature of the System Hooks component.
8.8
HIGH
CVE-2018-14604 2018-07-27 00:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline.
6.1
MEDIUM
CVE-2018-14605 2018-07-27 00:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the branch name during a Web IDE file commit.
5.4
MEDIUM
CVE-2018-14606 2018-07-27 00:00 +00:00 An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion.
5.4
MEDIUM
CVE-2018-14364 2018-07-18 17:00 +00:00 GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.
9.8
CRITICAL

More information
Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.