Vendor
GitLab
1,178 known vulnerabilities.
Products
GitLab 1,112
GitLab CE/EE 22
GitLab Community and Enterprise Editions 13
GitLab EE 10
GitLab Runner 6
GitLab AI Gateway 4
DAST 2
gitlab-vscode-extension 2
GitLab Community Edition 2
GitLab Enterprise Edition 2
gitlab-shell 2
GitLab DAST API scanner 1
GitLab Language Server 1
GitLab Pages 1
GitLab Community Edition and GitLab Enterprise Edition 1
GitLab VSCode Fork 1
Gitaly 1
DAST API scanner 1
Community Edition and Enterprise Edition 0
Community Edition, Enterprise Edition 0
Enterprise Edition 0
1,178 results · Feed
-
Medium 4.3
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting…
-
Medium 4.3
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 …
-
Medium 5.3
A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >…
-
Medium 4.3
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed…
-
Low 3.1
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics st…
-
Medium 5.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information discl…
-
Medium 5.3
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This af…
-
Medium 4.0
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms …
-
Medium 4.3
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via…
-
Medium 4.3
A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to t…
-
Medium 5.5
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that all…
-
High 7.6
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malic…
-
High 8.2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request co…
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LF…
-
High 7.1
Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to s…
-
Medium 4.3
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a …
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could…
-
Low 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab insta…
-
Medium 6.5
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable name…
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name ch…
-
Low 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to p…
-
Low 2.5
Gitaly Insufficient Session Expiration vulnerability
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
-
Medium 4.7
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access …
-
Medium 5.3
Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This in…
-
Medium 6.0
An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions s…
-
Medium 4.9
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permiss…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Previe…
-
High 8.7CVE-2020-13340 EPSS 67%
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job…
-
Medium 5.7
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are st…
-
Low 2.7
An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at…
-
Medium 6.5
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allo…
-
Medium 5.9
In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/g…
-
Critical 9.1
A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the…
-
Medium 4.3
Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account …
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a li…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pr…
-
Medium 5.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site script…
-
High 7.2
An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload …
-
Medium 4.0
An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored …