GitLab vulnerabilities
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-39889In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protec
- CVE-2021-39870In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by a
- CVE-2021-39881In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrar
- CVE-2021-39886Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up t
- CVE-2021-39891In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the e
- CVE-2021-39866A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
- CVE-2021-39872In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still acc
- CVE-2021-39894In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers t
- CVE-2021-39869In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
- CVE-2021-39867In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigg
- CVE-2021-39875In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visit
- CVE-2021-39884In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileg
- CVE-2021-39882In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.
- CVE-2021-39888In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting fro
- CVE-2021-39893A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.
- CVE-2021-39878A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to exe
- CVE-2021-39887A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to exe
- CVE-2021-39868In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repos
- CVE-2021-22259A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.
- CVE-2021-39874In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.
- CVE-2021-39883Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5,
- CVE-2021-39871In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed
- CVE-2021-39899In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change pas
- CVE-2021-39900Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a
- CVE-2021-39896In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may b
- CVE-2021-39873In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visit
- CVE-2021-39879Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable
- CVE-2021-39877A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with
- CVE-2021-39885A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 b
- CVE-2021-22239An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.