GitLab CVEs
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-22236Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application.
- CVE-2021-22242Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site sc
- CVE-2021-22237Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled.
- CVE-2021-22243Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another ema
- CVE-2021-22244Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulne
- CVE-2021-22247Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
- CVE-2021-22245Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossibl
- CVE-2021-22256Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track th
- CVE-2021-22250Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administ
- CVE-2021-22249A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
- CVE-2021-22248Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipe
- CVE-2021-22251Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emai
- CVE-2021-22252A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variab
- CVE-2021-22253Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger depl
- CVE-2021-22238An issue has been discovered in GitLab affecting all versions starting with 13.3.
- CVE-2021-22246A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6.
- CVE-2021-22254Under very specific conditions a user could be impersonated using Gitlab shell.
- CVE-2021-22234An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 bef
- CVE-2021-22241An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0.
- CVE-2021-22240Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap be
- CVE-2021-22233An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details
- CVE-2021-22224A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed a
- CVE-2021-22225Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulne
- CVE-2021-22230Improper code rendering while rendering merge requests could be exploited to submit malicious code.
- CVE-2021-22227A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious li
- CVE-2021-22231A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile pa
- CVE-2021-22223Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT
- CVE-2021-22228An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versi
- CVE-2021-22226Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since versi
- CVE-2021-22232HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE