GitLab
by GitLab Inc.
Source repositories
CVEs (1,214)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-22186 | 0.00 | — | 0.01 | Mar 24, 2021 | An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners | |||
| CVE-2021-22185 | 0.00 | — | 0.01 | Mar 24, 2021 | Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki | |||
| CVE-2021-22192 | 0.00 | — | 0.13 | Mar 24, 2021 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server. | |||
| CVE-2021-22183 | 0.00 | — | 0.01 | Mar 4, 2021 | An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions. | |||
| CVE-2021-22189 | 0.00 | — | 0.01 | Mar 4, 2021 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues. | |||
| CVE-2021-22182 | 0.00 | — | 0.01 | Mar 3, 2021 | An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. | |||
| CVE-2021-22188 | 0.00 | — | 0.01 | Mar 3, 2021 | An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs. | |||
| CVE-2021-22187 | 0.00 | — | 0.01 | Mar 2, 2021 | An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted. | |||
| CVE-2020-26414 | 0.00 | — | 0.02 | Jan 15, 2021 | An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string. | |||
| CVE-2021-22166 | 0.00 | — | 0.01 | Jan 15, 2021 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method | |||
| CVE-2021-22167 | 0.00 | — | 0.02 | Jan 15, 2021 | An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository | |||
| CVE-2021-22171 | 0.00 | — | 0.01 | Jan 15, 2021 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link | |||
| CVE-2021-22168 | 0.00 | — | 0.01 | Jan 15, 2021 | A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. | |||
| CVE-2020-26411 | 0.00 | — | 0.01 | Dec 11, 2020 | A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused. | |||
| CVE-2020-26412 | 0.00 | — | 0.01 | Dec 11, 2020 | Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. | |||
| CVE-2020-26416 | 0.00 | — | 0.00 | Dec 11, 2020 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2. | |||
| CVE-2020-26415 | 0.00 | — | 0.01 | Dec 11, 2020 | Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2. | |||
| CVE-2020-13359 | 0.00 | — | 0.01 | Nov 18, 2020 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4,… | |||
| CVE-2020-26405 | 0.00 | — | 0.01 | Nov 17, 2020 | Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2. | |||
| CVE-2020-13349 | 0.00 | — | 0.01 | Nov 17, 2020 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5,… |
- CVE-2021-22186Mar 24, 2021risk 0.00cvss —epss 0.01
An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners
- CVE-2021-22185Mar 24, 2021risk 0.00cvss —epss 0.01
Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki
- CVE-2021-22192Mar 24, 2021risk 0.00cvss —epss 0.13
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.
- CVE-2021-22183Mar 4, 2021risk 0.00cvss —epss 0.01
An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.
- CVE-2021-22189Mar 4, 2021risk 0.00cvss —epss 0.01
Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.
- CVE-2021-22182Mar 3, 2021risk 0.00cvss —epss 0.01
An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.
- CVE-2021-22188Mar 3, 2021risk 0.00cvss —epss 0.01
An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.
- CVE-2021-22187Mar 2, 2021risk 0.00cvss —epss 0.01
An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.
- CVE-2020-26414Jan 15, 2021risk 0.00cvss —epss 0.02
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.
- CVE-2021-22166Jan 15, 2021risk 0.00cvss —epss 0.01
An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method
- CVE-2021-22167Jan 15, 2021risk 0.00cvss —epss 0.02
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository
- CVE-2021-22171Jan 15, 2021risk 0.00cvss —epss 0.01
Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link
- CVE-2021-22168Jan 15, 2021risk 0.00cvss —epss 0.01
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.
- CVE-2020-26411Dec 11, 2020risk 0.00cvss —epss 0.01
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.
- CVE-2020-26412Dec 11, 2020risk 0.00cvss —epss 0.01
Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.
- CVE-2020-26416Dec 11, 2020risk 0.00cvss —epss 0.00
Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
- CVE-2020-26415Dec 11, 2020risk 0.00cvss —epss 0.01
Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.
- CVE-2020-13359Nov 18, 2020risk 0.00cvss —epss 0.01
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4,…
- CVE-2020-26405Nov 17, 2020risk 0.00cvss —epss 0.01
Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
- CVE-2020-13349Nov 17, 2020risk 0.00cvss —epss 0.01
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5,…
Page 48 of 61