Vulnerabilities (CVE)

Filtered by vendor Gitlab Subscribe
Total 1001 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-39881 1 Gitlab 1 Gitlab 2021-10-09 3.5 LOW 3.5 LOW
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
CVE-2021-39886 1 Gitlab 1 Gitlab 2021-10-09 4.0 MEDIUM 4.3 MEDIUM
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
CVE-2021-39887 1 Gitlab 1 Gitlab 2021-10-08 3.5 LOW 5.4 MEDIUM
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf.
CVE-2021-22259 1 Gitlab 1 Gitlab 2021-10-08 4.0 MEDIUM 6.5 MEDIUM
A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.
CVE-2021-22239 1 Gitlab 1 Gitlab 2021-09-21 4.0 MEDIUM 4.3 MEDIUM
An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.
CVE-2021-22194 1 Gitlab 1 Gitlab 2021-09-14 2.1 LOW 4.4 MEDIUM
In all versions of GitLab, marshalled session keys were being stored in Redis.
CVE-2019-15594 1 Gitlab 1 Gitlab 2021-09-14 4.0 MEDIUM 4.3 MEDIUM
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
CVE-2021-22256 1 Gitlab 1 Gitlab 2021-08-31 5.5 MEDIUM 5.4 MEDIUM
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status
CVE-2021-22247 1 Gitlab 1 Gitlab 2021-08-31 4.0 MEDIUM 4.3 MEDIUM
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
CVE-2021-22245 1 Gitlab 1 Gitlab 2021-08-31 4.0 MEDIUM 2.7 LOW
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view
CVE-2021-22243 1 Gitlab 1 Gitlab 2021-08-31 4.0 MEDIUM 4.3 MEDIUM
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
CVE-2021-22237 1 Gitlab 1 Gitlab 2021-08-31 4.0 MEDIUM 4.9 MEDIUM
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2
CVE-2021-22242 1 Gitlab 1 Gitlab 2021-08-31 3.5 LOW 5.4 MEDIUM
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown
CVE-2021-22236 1 Gitlab 1 Gitlab 2021-08-31 6.5 MEDIUM 8.8 HIGH
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.
CVE-2021-22253 1 Gitlab 1 Gitlab 2021-08-30 4.9 MEDIUM 5.4 MEDIUM
Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed
CVE-2021-22251 1 Gitlab 1 Gitlab 2021-08-28 4.0 MEDIUM 4.3 MEDIUM
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
CVE-2021-22249 1 Gitlab 1 Gitlab 2021-08-28 4.0 MEDIUM 4.3 MEDIUM
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
CVE-2021-22254 1 Gitlab 1 Gitlab 2021-08-26 3.5 LOW 4.3 MEDIUM
Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.
CVE-2021-22246 1 Gitlab 1 Gitlab 2021-08-26 4.0 MEDIUM 6.5 MEDIUM
A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks.
CVE-2021-22238 1 Gitlab 1 Gitlab 2021-08-26 3.5 LOW 5.4 MEDIUM
An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.