GitLab
by GitLab Inc.
Source repositories
CVEs (1,462)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-11506 | Hig | 0.49 | 7.5 | 0.01 | Apr 22, 2020 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling. | ||
| CVE-2020-11505 | Hig | 0.49 | 7.5 | 0.01 | Apr 22, 2020 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling. | ||
| CVE-2020-10976 | Hig | 0.49 | 7.5 | 0.01 | Apr 8, 2020 | GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget. | ||
| CVE-2020-10954 | Hig | 0.49 | 7.5 | 0.01 | Mar 27, 2020 | GitLab through 12.9 is affected by a potential DoS in repository archive download. | ||
| CVE-2020-10953 | Hig | 0.49 | 7.5 | 0.02 | Mar 27, 2020 | In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. | ||
| CVE-2020-10073 | Hig | 0.49 | 7.5 | 0.01 | Mar 13, 2020 | GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page. | ||
| CVE-2020-10089 | Hig | 0.49 | 7.5 | 0.01 | Mar 13, 2020 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, | ||
| CVE-2020-10087 | Hig | 0.49 | 7.5 | 0.01 | Mar 13, 2020 | GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user. | ||
| CVE-2019-13121 | Hig | 0.49 | 7.5 | 0.01 | Mar 10, 2020 | An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control. | ||
| CVE-2019-13003 | Hig | 0.49 | 7.5 | 0.01 | Mar 10, 2020 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption. | ||
| CVE-2019-12446 | Hig | 0.49 | 7.5 | 0.01 | Mar 10, 2020 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. | ||
| CVE-2019-12441 | Hig | 0.49 | 7.5 | 0.01 | Mar 10, 2020 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control. | ||
| CVE-2020-8795 | Hig | 0.49 | 7.5 | 0.01 | Feb 17, 2020 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. | ||
| CVE-2020-6833 | Hig | 0.49 | 7.5 | 0.01 | Feb 5, 2020 | An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling. | ||
| CVE-2020-7978 | Hig | 0.49 | 7.5 | 0.01 | Feb 5, 2020 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. | ||
| CVE-2020-7972 | Hig | 0.49 | 7.5 | 0.01 | Feb 5, 2020 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). | ||
| CVE-2020-7969 | Hig | 0.49 | 7.5 | 0.01 | Feb 5, 2020 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. | ||
| CVE-2020-7968 | Hig | 0.49 | 7.5 | 0.01 | Feb 5, 2020 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. | ||
| CVE-2020-7966 | Hig | 0.49 | 7.5 | 0.02 | Feb 5, 2020 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. | ||
| CVE-2019-5472 | Hig | 0.49 | 7.5 | 0.02 | Jan 28, 2020 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensitive Information) via request smuggling.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.
- risk 0.49cvss 7.5epss 0.01
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
- risk 0.49cvss 7.5epss 0.01
GitLab through 12.9 is affected by a potential DoS in repository archive download.
- risk 0.49cvss 7.5epss 0.02
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
- risk 0.49cvss 7.5epss 0.01
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.
- risk 0.49cvss 7.5epss 0.01
GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
- risk 0.49cvss 7.5epss 0.01
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make requests to local network resources. It has Incorrect Access Control.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control.
- risk 0.49cvss 7.5epss 0.01
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.
- risk 0.49cvss 7.5epss 0.01
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
- risk 0.49cvss 7.5epss 0.01
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
- risk 0.49cvss 7.5epss 0.01
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
- risk 0.49cvss 7.5epss 0.01
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
- risk 0.49cvss 7.5epss 0.02
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
- risk 0.49cvss 7.5epss 0.02
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.
Page 14 of 74