CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Gitlab » Gitlab » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-0477 DoS 2022-04-25 2022-05-05
4.0
 None Remote Low ??? None None Partial
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.
2 CVE-2022-0344 2022-03-28 2022-04-04
4.3
 None Remote Medium Not required Partial None None
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
3 CVE-2022-0283 601 2022-03-28 2022-04-04
5.8
 None Remote Medium Not required Partial Partial None
An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL.
4 CVE-2022-0249 918 2022-03-28 2022-04-04
6.4
 None Remote Low Not required Partial Partial None
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
5 CVE-2022-0136 918 2022-03-28 2022-04-04
5.5
 None Remote Low ??? Partial Partial None
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
6 CVE-2022-0123 295 2022-03-28 2022-04-04
4.9
 None Remote Medium ??? Partial Partial None
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
7 CVE-2021-39890 287 Bypass 2021-12-06 2021-12-07
7.5
 None Remote Low Not required Partial Partial Partial
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.
8 CVE-2021-22229 2021-07-06 2021-07-08
4.3
 None Remote Medium Not required Partial None None
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member.
9 CVE-2021-22228 287 2021-07-06 2022-05-12
4.0
 None Remote Low ??? Partial None None
An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versions starting from 14.0 before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql.
10 CVE-2021-22225 79 XSS 2021-07-07 2021-07-09
3.5
 None Remote Medium ??? None Partial None
Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown
11 CVE-2021-22224 352 CSRF 2021-07-07 2021-07-09
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim
12 CVE-2021-22220 79 XSS 2021-06-08 2021-12-10
3.5
 None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.
13 CVE-2021-22214 918 2021-06-08 2021-06-16
4.3
 None Remote Medium Not required Partial None None
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited
14 CVE-2021-22170 326 2021-12-06 2021-12-07
5.0
 None Remote Low Not required Partial None None
Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content
15 CVE-2020-26411 404 2020-12-11 2020-12-14
4.0
 None Remote Low ??? None None Partial
A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.
16 CVE-2020-13331 79 XSS 2020-09-30 2020-10-02
3.5
 None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.
17 CVE-2020-13330 79 XSS 2020-09-30 2020-10-02
3.5
 None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.
18 CVE-2020-13329 79 XSS 2020-09-30 2020-10-02
3.5
 None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.
19 CVE-2020-13328 79 XSS 2020-09-30 2020-10-02
3.5
 None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.
20 CVE-2020-13326 Bypass 2020-09-30 2020-10-02
3.5
 None Remote Medium ??? None Partial None
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed.
21 CVE-2020-13325 DoS 2020-09-30 2020-10-02
5.5
 None Remote Low ??? None Partial Partial
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service.
22 CVE-2020-13324 2020-09-30 2020-10-08
3.5
 None Remote Medium ??? Partial None None
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API.
23 CVE-2020-13323 863 2020-09-30 2021-07-21
4.3
 None Remote Medium Not required Partial None None
A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos
24 CVE-2020-13322 863 2020-09-30 2020-10-02
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy tokens.
25 CVE-2020-13321 Bypass 2020-09-30 2020-10-02
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.
26 CVE-2020-13320 863 2020-09-30 2021-07-21
4.0
 None Remote Low ??? Partial None None
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.
27 CVE-2020-13319 862 2020-09-30 2020-10-02
4.0
 None Remote Low ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.
28 CVE-2020-13315 DoS 2020-09-14 2020-09-21
5.0
 None Remote Low Not required None None Partial
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.
29 CVE-2020-13310 DoS 2020-09-14 2020-09-16
4.0
 None Remote Low ??? None None Partial
A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.
30 CVE-2020-13309 918 2020-09-14 2020-09-21
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.
31 CVE-2020-13306 770 DoS 2020-09-14 2020-09-16
5.0
 None Remote Low Not required None None Partial
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.
32 CVE-2020-13305 613 2020-09-14 2020-09-17
4.0
 None Remote Low ??? Partial None None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.
33 CVE-2020-13304 287 2020-09-14 2021-07-21
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.
34 CVE-2020-13302 613 2020-09-14 2020-09-17
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.
35 CVE-2020-13301 79 XSS 2020-09-14 2020-09-16
3.5
 None Remote Medium ??? None Partial None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.
36 CVE-2020-13298 20 2020-09-14 2021-07-21
5.0
 None Remote Low Not required Partial None None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.
37 CVE-2020-13297 287 Bypass 2020-09-14 2021-07-21
4.9
 None Remote Medium ??? Partial Partial None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.
38 CVE-2020-13296 862 2020-09-30 2020-10-02
7.5
 None Remote Low Not required Partial Partial Partial
An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens
39 CVE-2020-13294 2020-08-10 2020-10-06
5.5
 None Remote Low ??? Partial Partial None
In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
40 CVE-2020-13293 704 2020-08-10 2021-07-21
5.5
 None Remote Low ??? None Partial Partial
In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
41 CVE-2020-13292 287 Bypass 2020-08-10 2020-08-11
5.5
 None Remote Low ??? Partial Partial None
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.
42 CVE-2019-15592 2020-02-14 2021-08-27
4.0
 None Remote Low ??? Partial None None
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
43 CVE-2018-8971 20 2018-03-24 2019-03-05
7.5
 None Remote Low Not required Partial Partial Partial
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.
44 CVE-2017-8778 79 XSS 2017-05-04 2017-05-15
4.3
 None Remote Medium Not required None Partial None
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.
45 CVE-2014-8540 264 2018-01-05 2018-01-18
4.0
 None Remote Low ??? None Partial None
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
46 CVE-2013-4583 269 +Priv 2020-01-28 2020-02-03
6.5
 None Remote Low ??? Partial Partial Partial
The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.
47 CVE-2013-4582 829 2020-01-28 2020-02-04
4.0
 None Remote Low ??? Partial None None
The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.
48 CVE-2013-4580 287 Bypass 2014-05-12 2016-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.
Total number of vulnerabilities : 48   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.