GitLab CVEs
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-13317A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4.
- CVE-2020-13318A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13284A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13289A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13287A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13316A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13299A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.
- CVE-2020-13300GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the au
- CVE-2020-13286For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forger
- CVE-2020-13281For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature
- CVE-2020-13280For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.
- CVE-2020-13285For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.
- CVE-2020-13283For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.
- CVE-2020-13282For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup
- CVE-2020-13290In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page
- CVE-2020-13291In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.
- CVE-2020-13288In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page
- CVE-2020-13292In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.
- CVE-2020-13295For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
- CVE-2020-13294In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
- CVE-2020-13293In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
- CVE-2020-13279Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
- CVE-2020-13263An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allo
- CVE-2020-13264Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster
- CVE-2020-13261Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials v
- CVE-2020-13262Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload t
- CVE-2020-13275A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1
- CVE-2020-13274A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitL
- CVE-2020-13273A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
- CVE-2020-13265User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification