CVE-2020-10078
Published Mar 13, 2020GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
Vendor archive
gitlab CVEs
Beta · best-effort1,422 CVEs tagged to vendor gitlab — 57 Critical, 295 High, 889 Medium, 180 Low, 1 Unrated.
CVE-2020-10535
Published Mar 12, 2020GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
CVE-2019-13121
Published Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed an attacker to make…
CVE-2019-13011
Published Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of me…
CVE-2019-13010
Published Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It al…
CVE-2019-13009
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized use…
CVE-2019-13007
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads…
CVE-2019-13006
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of rela…
CVE-2019-13005
Published Mar 10, 2020An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that dis…
CVE-2019-13004
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become…
CVE-2019-13003
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Unc…
CVE-2019-13002
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It ha…
CVE-2019-13001
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthoriz…
CVE-2019-12446
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message.
CVE-2019-12445
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted proj…
CVE-2019-12444
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerabil…
CVE-2019-12443
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an…
CVE-2019-12442
Published Mar 10, 2020An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a p…
CVE-2019-12441
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of…
CVE-2019-12434
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination U…
CVE-2019-12433
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal pro…
CVE-2019-12432
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidentia…
CVE-2019-12431
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It…
CVE-2019-12430
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely thro…
CVE-2019-12429
Published Mar 10, 2020An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidenti…
Showing 1,101-1,125 of 1,422 CVEsPage 45 of 57