CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Gitlab » Gitlab : Security Vulnerabilities (CVSS score between 1 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-13282 281 2020-08-13 2020-08-19
4.9
 None Remote Medium ??? Partial Partial None
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.
2 CVE-2020-13297 287 Bypass 2020-09-14 2021-07-21
4.9
 None Remote Medium ??? Partial Partial None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.
3 CVE-2020-13318 863 2020-09-14 2021-07-21
4.9
 None Remote Medium ??? Partial Partial None
A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.
4 CVE-2021-22226 2021-07-06 2021-07-09
4.9
 None Remote Medium ??? Partial Partial None
Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9
5 CVE-2021-22253 863 2021-08-23 2021-08-30
4.9
 None Remote Medium ??? None Partial Partial
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed
6 CVE-2022-0123 295 2022-03-28 2022-04-04
4.9
 None Remote Medium ??? Partial Partial None
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
7 CVE-2022-1944 863 2022-06-06 2022-06-13
4.9
 None Remote Medium ??? Partial Partial None
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
8 CVE-2013-7316 79 1 XSS 2014-01-24 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html.
9 CVE-2014-3456 79 XSS 2014-05-13 2014-05-14
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
10 CVE-2017-0917 79 XSS 2018-03-21 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
11 CVE-2017-0923 79 XSS 2018-03-21 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
12 CVE-2017-0924 79 XSS 2018-03-21 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.
13 CVE-2017-8778 79 XSS 2017-05-04 2017-05-15
4.3
 None Remote Medium Not required None Partial None
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.
14 CVE-2017-17716 295 2017-12-17 2018-01-04
4.3
 None Remote Medium Not required Partial None None
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
15 CVE-2018-9243 79 XSS 2018-04-05 2019-02-27
4.3
 None Remote Medium Not required None Partial None
GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
16 CVE-2018-9244 79 XSS 2018-04-05 2019-02-27
4.3
 None Remote Medium Not required None Partial None
GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
17 CVE-2018-10379 79 XSS 2018-05-31 2018-06-29
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.
18 CVE-2018-14604 79 XSS 2018-07-27 2018-09-18
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline.
19 CVE-2018-16050 79 XSS 2018-10-03 2018-11-19
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
20 CVE-2018-18642 79 XSS 2018-12-04 2018-12-21
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS.
21 CVE-2018-18643 79 XSS 2019-04-25 2019-04-26
4.3
 None Remote Medium Not required None Partial None
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.
22 CVE-2018-18645 200 +Info 2018-12-04 2018-12-21
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exposure via unsubscribe links in email replies.
23 CVE-2018-19493 79 XSS 2019-07-10 2019-07-11
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.
24 CVE-2018-19572 362 2019-07-10 2019-07-11
4.3
 None Remote Medium Not required Partial None None
GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.
25 CVE-2019-6784 79 XSS 2019-09-09 2019-09-10
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.
26 CVE-2019-6796 79 XSS 2019-04-11 2019-09-09
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.
27 CVE-2019-7176 2019-09-09 2020-08-24
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
28 CVE-2019-9171 200 +Info 2019-04-17 2021-07-21
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5).
29 CVE-2019-9172 200 +Info 2019-04-17 2021-07-21
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5).
30 CVE-2019-9179 200 +Info 2019-04-17 2019-04-17
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5).
31 CVE-2019-9219 639 2019-04-17 2020-08-24
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).
32 CVE-2019-11547 79 XSS 2019-09-09 2021-07-21
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.
33 CVE-2019-12442 79 XSS 2020-03-10 2020-03-10
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.
34 CVE-2019-12444 79 XSS 2020-03-10 2020-03-10
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
35 CVE-2019-13010 2020-03-10 2020-08-24
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption.
36 CVE-2019-15586 79 XSS 2020-01-28 2020-01-28
4.3
 None Remote Medium Not required None Partial None
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
37 CVE-2019-15724 79 XSS 2019-09-16 2020-08-24
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.
38 CVE-2019-15739 79 XSS 2019-09-16 2019-09-17
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
39 CVE-2019-18454 79 XSS 2019-11-26 2019-11-27
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.
40 CVE-2019-20148 200 +Info 2020-01-13 2021-07-21
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.
41 CVE-2020-7971 79 XSS 2020-02-05 2020-02-06
4.3
 None Remote Medium Not required None Partial None
GitLab EE 11.0 and later through 12.7.2 allows XSS.
42 CVE-2020-7973 79 XSS 2020-02-05 2020-02-06
4.3
 None Remote Medium Not required None Partial None
GitLab through 12.7.2 allows XSS.
43 CVE-2020-7977 276 2020-02-05 2020-02-06
4.3
 None Remote Medium Not required None Partial None
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
44 CVE-2020-7979 276 2020-02-05 2020-02-07
4.3
 None Remote Medium Not required Partial None None
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
45 CVE-2020-10076 79 XSS 2020-03-13 2020-03-17
4.3
 None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.
46 CVE-2020-10078 79 XSS 2020-03-13 2020-03-17
4.3
 None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
47 CVE-2020-10091 79 XSS 2020-03-13 2020-03-16
4.3
 None Remote Medium Not required None Partial None
GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.
48 CVE-2020-10092 79 XSS 2020-03-13 2020-03-16
4.3
 None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.
49 CVE-2020-10535 Bypass 2020-03-12 2020-03-17
4.3
 None Remote Medium Not required None Partial None
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
50 CVE-2020-13262 79 XSS 2020-06-19 2021-07-21
4.3
 None Remote Medium Not required None Partial None
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
Total number of vulnerabilities : 388   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.