Vulnerabilities (CVE)

Filtered by vendor Gitlab Subscribe
Total 1001 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-1999 1 Gitlab 1 Gitlab 2022-07-13 4.3 MEDIUM 5.3 MEDIUM
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.
CVE-2022-1981 1 Gitlab 1 Gitlab 2022-07-13 3.5 LOW 2.7 LOW
An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the 'Invite a group' feature to invite a group that has members that don't comply with domain allow-list.
CVE-2022-1963 1 Gitlab 1 Gitlab 2022-07-13 5.0 MEDIUM 5.3 MEDIUM
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users.
CVE-2022-2281 1 Gitlab 1 Gitlab 2022-07-13 4.3 MEDIUM 5.3 MEDIUM
An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows disclosure of release titles if group milestones are associated with any project releases.
CVE-2022-2250 1 Gitlab 1 Gitlab 2022-07-13 5.8 MEDIUM 6.1 MEDIUM
An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL.
CVE-2022-2235 1 Gitlab 1 Gitlab 2022-07-13 3.5 LOW 5.4 MEDIUM
Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link
CVE-2022-2230 1 Gitlab 1 Gitlab 2022-07-13 3.5 LOW 4.8 MEDIUM
A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.
CVE-2021-22169 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 4.3 MEDIUM
An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.
CVE-2021-39900 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 2.7 LOW
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.
CVE-2021-39898 1 Gitlab 1 Gitlab 2022-07-12 5.0 MEDIUM 5.3 MEDIUM
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from.
CVE-2020-13270 1 Gitlab 1 Gitlab 2022-07-12 6.5 MEDIUM 8.8 HIGH
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
CVE-2021-22180 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 4.3 MEDIUM
An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.
CVE-2021-22195 1 Gitlab 1 Gitlab-vscode-extension 2022-07-12 6.8 MEDIUM 7.8 HIGH
Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system
CVE-2021-39891 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 4.9 MEDIUM
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
CVE-2020-10087 1 Gitlab 1 Gitlab 2022-07-12 5.0 MEDIUM 7.5 HIGH
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.
CVE-2021-22205 1 Gitlab 1 Gitlab 2022-07-12 7.5 HIGH 10.0 CRITICAL
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
CVE-2021-39916 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 4.3 MEDIUM
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2.
CVE-2021-22252 1 Gitlab 1 Gitlab 2022-07-12 4.0 MEDIUM 6.5 MEDIUM
A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers
CVE-2021-39866 1 Gitlab 1 Gitlab 2022-07-12 5.5 MEDIUM 5.4 MEDIUM
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
CVE-2021-22184 1 Gitlab 1 Gitlab 2022-07-12 2.1 LOW 5.5 MEDIUM
An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.