921 results · Feed
-
Medium 5.9
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 …
-
Low 3.5
Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting …
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions star…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions st…
-
High 7.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions star…
-
Low 3.1
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting fro…
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions star…
-
Medium 6.2
Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's enc…
-
Low 3.1
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 …
-
Low 3.7
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may a…
-
Medium 4.3
An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic informat…
-
Low 1.7
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting…
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data fro…
-
Medium 4.3
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 1…
-
Medium 6.0
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project…
-
High 7.7
A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13…
-
Low 2.7
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiti…
-
Medium 4.4
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all vers…
-
Low 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a proj…
-
High 8.7CVE-2021-39906 EPSS 61%
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaS…
-
Medium 6.5
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility l…
-
Medium 4.3
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the se…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting f…
-
Medium 6.5
apollo_upload_server has Denial of Service vulnerability
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny a…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14…
-
Medium 4.3
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
-
Medium 5.4
Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting f…
-
Medium 6.8
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting f…
-
Medium 4.3
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint …
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import ena…
-
Low 3.5
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client appl…
-
Low 2.6
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starti…
-
Medium 5.9
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are…
-
Medium 5.4
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project ac…
-
Medium 6.5
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired …
-
Medium 5.4
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may b…
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.