GitLab CVEs
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-26407A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to pe
- CVE-2020-13359The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintain
- CVE-2020-13356An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9.
- CVE-2020-13355An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14.
- CVE-2020-26405Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbit
- CVE-2020-13349An issue has been discovered in GitLab EE affecting all versions starting from 8.12.
- CVE-2020-13348An issue has been discovered in GitLab EE affecting all versions starting from 10.2.
- CVE-2020-13350CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to
- CVE-2020-13351Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for sche
- CVE-2020-13354A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6.
- CVE-2020-13352Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group.
- CVE-2020-13353When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
- CVE-2020-13358A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects.
- CVE-2020-26406Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3.
- CVE-2020-13327An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 b
- CVE-2020-13341An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2.
- CVE-2020-13339An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview.
- CVE-2020-13340An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
- CVE-2020-13344An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2.
- CVE-2020-13342An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmat
- CVE-2020-13346Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to a
- CVE-2020-13334In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the co
- CVE-2020-13347A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1.
- CVE-2020-13335Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/tran
- CVE-2020-13333A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3.
- CVE-2020-13345An issue has been discovered in GitLab affecting all versions starting from 10.8.
- CVE-2020-13343An issue has been discovered in GitLab affecting all versions starting from 11.2.
- CVE-2020-13338An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2.
- CVE-2020-13337An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a grou
- CVE-2020-13336An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13.