Total
988 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-39879 | 1 Gitlab | 1 Gitlab | 2021-10-12 | 4.0 MEDIUM | 3.5 LOW |
| Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication | |||||
| CVE-2021-39877 | 1 Gitlab | 1 Gitlab | 2021-10-12 | 4.3 MEDIUM | 5.5 MEDIUM |
| A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file. | |||||
| CVE-2021-39874 | 1 Gitlab | 1 Gitlab | 2021-10-12 | 4.0 MEDIUM | 4.3 MEDIUM |
| In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands. | |||||
| CVE-2021-39899 | 1 Gitlab | 1 Gitlab | 2021-10-12 | 1.9 LOW | 4.2 MEDIUM |
| In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations. | |||||
| CVE-2021-39896 | 1 Gitlab | 1 Gitlab | 2021-10-12 | 5.5 MEDIUM | 3.8 LOW |
| In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues. | |||||
| CVE-2021-39893 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. | |||||
| CVE-2021-22257 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances. | |||||
| CVE-2021-22258 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses | |||||
| CVE-2021-22264 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted. | |||||
| CVE-2021-39870 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call. | |||||
| CVE-2021-39881 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 3.5 LOW | 3.5 LOW |
| In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description. | |||||
| CVE-2021-39886 | 1 Gitlab | 1 Gitlab | 2021-10-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references. | |||||
| CVE-2021-39887 | 1 Gitlab | 1 Gitlab | 2021-10-08 | 3.5 LOW | 5.4 MEDIUM |
| A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf. | |||||
| CVE-2021-22259 | 1 Gitlab | 1 Gitlab | 2021-10-08 | 4.0 MEDIUM | 6.5 MEDIUM |
| A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. | |||||
| CVE-2021-22239 | 1 Gitlab | 1 Gitlab | 2021-09-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. | |||||
| CVE-2021-22194 | 1 Gitlab | 1 Gitlab | 2021-09-14 | 2.1 LOW | 4.4 MEDIUM |
| In all versions of GitLab, marshalled session keys were being stored in Redis. | |||||
| CVE-2019-15594 | 1 Gitlab | 1 Gitlab | 2021-09-14 | 4.0 MEDIUM | 4.3 MEDIUM |
| GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. | |||||
| CVE-2021-22256 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 5.5 MEDIUM | 5.4 MEDIUM |
| Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status | |||||
| CVE-2021-22247 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 4.0 MEDIUM | 4.3 MEDIUM |
| Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics | |||||
| CVE-2021-22245 | 1 Gitlab | 1 Gitlab | 2021-08-31 | 4.0 MEDIUM | 2.7 LOW |
| Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view | |||||