Vendor
GitLab
1,178 known vulnerabilities.
Products
GitLab 1,112
GitLab CE/EE 22
GitLab Community and Enterprise Editions 13
GitLab EE 10
GitLab Runner 6
GitLab AI Gateway 4
DAST 2
gitlab-vscode-extension 2
GitLab Community Edition 2
GitLab Enterprise Edition 2
gitlab-shell 2
GitLab DAST API scanner 1
GitLab Language Server 1
GitLab Pages 1
GitLab Community Edition and GitLab Enterprise Edition 1
GitLab VSCode Fork 1
Gitaly 1
DAST API scanner 1
Community Edition and Enterprise Edition 0
Community Edition, Enterprise Edition 0
Enterprise Edition 0
1,178 results · Feed
-
Medium 6.5
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility l…
-
Medium 4.3
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the se…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting f…
-
Medium 6.5
apollo_upload_server has Denial of Service vulnerability
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny a…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14…
-
Medium 4.3
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
-
Medium 5.4
Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before…
-
Medium 5.3
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting f…
-
Medium 6.8
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting f…
-
Medium 4.3
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint …
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import ena…
-
Low 3.5
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client appl…
-
Low 2.6
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starti…
-
Medium 5.9
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are…
-
Medium 5.4
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project ac…
-
Medium 6.5
In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired …
-
Medium 5.4
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may b…
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
-
Medium 6.5
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by…
-
Medium 5.3
In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or pu…
-
Medium 4.3
In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a pr…
-
Medium 5.3
In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information ab…
-
Medium 4.3
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all …
-
Medium 5.3
A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without aut…
-
Medium 5.8
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allow…
-
High 7.3
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allow…
-
Medium 4.3
In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project…
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in depen…
-
Medium 4.3
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git comman…
-
Medium 4.3
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting fro…
-
Medium 4.3
In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import…
-
Low 2.9
In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s passwo…
-
Low 2.0
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in …
-
Low 3.8
In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersona…
-
Medium 4.3
In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to t…
-
Low 2.2
Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim'…
-
High 7.7
A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resou…
-
High 8.7
A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions…
-
Medium 5.0
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.