GitLab vulnerabilities
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-39945Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 befo
- CVE-2021-39944An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before
- CVE-2021-39940An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before
- CVE-2021-39918Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4,
- CVE-2021-39910An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before
- CVE-2021-22170Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content
- CVE-2021-39890It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.
- CVE-2021-39898In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the pr
- CVE-2021-39905An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups
- CVE-2021-39911An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.
- CVE-2021-39907A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7.
- CVE-2021-39904An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions s
- CVE-2021-39895In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an un
- CVE-2021-22260A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, all
- CVE-2021-39901In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoin
- CVE-2021-39913Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14
- CVE-2021-39897Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent gro
- CVE-2021-39912A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7.
- CVE-2021-39906Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vic
- CVE-2021-39909Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all ve
- CVE-2021-39903In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a
- CVE-2021-39902Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident
- CVE-2021-39914A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of r
- CVE-2021-22263An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.
- CVE-2021-39880A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all ve
- CVE-2021-22261A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st
- CVE-2021-22258The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
- CVE-2021-22262Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers
- CVE-2021-22257An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.
- CVE-2021-22264An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.