Vendor
GitLab
1,178 known vulnerabilities.
Products
704 results · Clear filters · Feed
-
Medium 4.8
Improper Control of Generation of Code ('Code Injection') in GitLab
An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to cre…
-
Medium 4.3
Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.
-
Medium 4.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML di…
-
Medium 4.3
Improper Validation of Specified Type of Input in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not loa…
-
Medium 4.9
Insertion of Sensitive Information into Log File in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a spec…
-
Medium 6.5
Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted …
-
Medium 5.4CVE-2023-2164 EPSS 66%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability…
-
Medium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export…
-
Medium 5.0
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
-
Medium 5.3
Insertion of Sensitive Information Into Sent Data in GitLab
A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
-
Medium 5.5
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by…
-
Medium 4.3
Incorrect Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and m…
-
Medium 5.3
Generation of Error Message Containing Sensitive Information in GitLab
An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
-
Medium 5.7
Incorrect Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protect…
-
Medium 4.1
Improper Encoding or Escaping of Output in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address f…
-
Medium 6.5
Authorization Bypass Through User-Controlled Key in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private …
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulne…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4…
-
Medium 6.5
Allocation of Resources Without Limits or Throttling in GitLab
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 be…
-
Medium 4.4
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions sta…
-
Medium 5.9
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starti…
-
Medium 4.4
Incorrect Privilege Assignment in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users…
-
Medium 4.3CVE-2023-0921 EPSS 84%
Allocation of Resources Without Limits or Throttling in GitLab
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturat…
-
Medium 6.5
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starti…
-
Medium 6.3
An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before…
-
Medium 4.8
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15…
-
Medium 4.9
An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions startin…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting …
-
Medium 5.4
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was …
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting f…
-
Medium 4.4
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all …
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions sta…
-
Medium 5.7
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from …
-
Medium 6.8
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions startin…
-
Medium 6.8
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions start…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting f…
-
Medium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting f…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and…
-
Medium 5.5
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.…