921 results · Feed
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by…
-
Medium 5.3
In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or pu…
-
Medium 4.3
In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a pr…
-
Medium 5.3
In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information ab…
-
Medium 4.3
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all …
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without aut…
-
Medium 5.8
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allow…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allow…
-
Medium 4.3
In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project…
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in depen…
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git comman…
-
Medium 4.3
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting fro…
-
Medium 4.3
In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import…
-
Low 2.9
In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s passwo…
-
Low 2.0
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in …
-
Low 3.8
In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersona…
-
Medium 4.3
In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to t…
-
Low 2.2
Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim'…
-
High 7.7
A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resou…
-
High 8.7
A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions…
-
Medium 5.0
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
-
Medium 5.5
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client app…
-
High 8.7CVE-2021-22242 EPSS 64%
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a…
-
Medium 6.6
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impers…
-
Medium 5.0
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL …
-
Low 3.1
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a rep…
-
Medium 4.3
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/C…
-
Low 2.7
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages i…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentr…
-
Medium 5.4
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation…
-
Medium 4.3
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a us…
-
Medium 5.3
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized us…
-
Medium 4.3
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to …
-
Medium 6.5
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to acces…
-
Medium 4.9
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary a…
-
Medium 6.8CVE-2021-22238 EPSS 72%
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS…
-
High 7.7
A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abus…
-
Low 3.1
Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE…
-
Critical 9.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions st…
-
High 8.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a st…