CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Gitlab : Security Vulnerabilities Published In 2020 (Cross Site Scripting (XSS))

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-26407 79 XSS 2020-12-10 2020-12-11
3.5
None Remote Medium ??? None Partial None
A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
2 CVE-2020-13345 79 XSS 2020-10-06 2020-10-15
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
3 CVE-2020-13340 79 XSS 2020-10-08 2020-10-14
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
4 CVE-2020-13339 79 XSS 2020-10-08 2020-10-08
6.0
None Remote Medium ??? Partial Partial Partial
An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.
5 CVE-2020-13338 79 XSS 2020-10-02 2020-10-08
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.
6 CVE-2020-13337 79 XSS 2020-10-02 2020-10-08
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.
7 CVE-2020-13336 79 XSS 2020-09-30 2020-10-08
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.
8 CVE-2020-13331 79 XSS 2020-09-30 2020-10-02
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.
9 CVE-2020-13330 79 XSS 2020-09-30 2020-10-02
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.
10 CVE-2020-13329 79 XSS 2020-09-30 2020-10-02
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.
11 CVE-2020-13328 79 XSS 2020-09-30 2020-10-02
3.5
None Remote Medium ??? None Partial None
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.
12 CVE-2020-13301 79 XSS 2020-09-14 2020-09-16
3.5
None Remote Medium ??? None Partial None
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.
13 CVE-2020-13288 79 XSS 2020-08-12 2020-08-14
3.5
None Remote Medium ??? None Partial None
In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page
14 CVE-2020-13285 79 XSS 2020-08-13 2021-05-03
3.5
None Remote Medium ??? None Partial None
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.
15 CVE-2020-13283 79 XSS 2020-08-13 2020-08-14
3.5
None Remote Medium ??? None Partial None
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.
16 CVE-2020-13271 79 Exec Code XSS 2020-06-10 2020-06-16
4.3
None Remote Medium Not required None Partial None
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
17 CVE-2020-13269 79 Exec Code XSS 2020-06-10 2020-06-16
4.3
None Remote Medium Not required None Partial None
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1
18 CVE-2020-13267 79 XSS 2020-06-10 2020-06-16
4.3
None Remote Medium Not required None Partial None
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
19 CVE-2020-13262 79 XSS 2020-06-19 2021-07-21
4.3
None Remote Medium Not required None Partial None
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
20 CVE-2020-12276 79 XSS 2020-04-29 2020-05-04
3.5
None Remote Medium ??? None Partial None
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
21 CVE-2020-10092 79 XSS 2020-03-13 2020-03-16
4.3
None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.
22 CVE-2020-10091 79 XSS 2020-03-13 2020-03-16
4.3
None Remote Medium Not required None Partial None
GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.
23 CVE-2020-10078 79 XSS 2020-03-13 2020-03-17
4.3
None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
24 CVE-2020-10076 79 XSS 2020-03-13 2020-03-17
4.3
None Remote Medium Not required None Partial None
GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.
25 CVE-2020-7973 79 XSS 2020-02-05 2020-02-06
4.3
None Remote Medium Not required None Partial None
GitLab through 12.7.2 allows XSS.
26 CVE-2020-7971 79 XSS 2020-02-05 2020-02-06
4.3
None Remote Medium Not required None Partial None
GitLab EE 11.0 and later through 12.7.2 allows XSS.
27 CVE-2019-19311 79 XSS 2020-01-03 2020-01-09
3.5
None Remote Medium ??? None Partial None
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
28 CVE-2019-15586 79 XSS 2020-01-28 2020-01-28
4.3
None Remote Medium Not required None Partial None
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
29 CVE-2019-12445 79 Exec Code XSS 2020-03-10 2020-03-10
3.5
None Remote Medium ??? None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.
30 CVE-2019-12444 79 XSS 2020-03-10 2020-03-10
4.3
None Remote Medium Not required None Partial None
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
31 CVE-2019-12442 79 XSS 2020-03-10 2020-03-10
4.3
None Remote Medium Not required None Partial None
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.
Total number of vulnerabilities : 31   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.