Total
1295 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2013-4580 | 1 Gitlab | 1 Gitlab | 2025-04-12 | 6.8 MEDIUM | N/A |
|
GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.
|
|||||
| CVE-2013-7316 | 1 Gitlab | 1 Gitlab | 2025-04-11 | 4.3 MEDIUM | N/A |
|
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html.
|
|||||
| CVE-2022-3870 | 1 Gitlab | 1 Gitlab | 2025-04-09 | N/A | 5.3 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
|
|||||
| CVE-2022-4167 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 5.3 MEDIUM |
|
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
|
|||||
| CVE-2022-4131 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 4.3 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
|
|||||
| CVE-2022-4037 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 6.4 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.
|
|||||
| CVE-2022-3613 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 5.8 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
|
|||||
| CVE-2022-3573 | 2 Abb, Gitlab | 2 Drive Composer, Gitlab | 2025-04-08 | N/A | 5.4 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
|
|||||
| CVE-2022-3514 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 4.3 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
|
|||||
| CVE-2023-0042 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 6.1 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
|
|||||
| CVE-2022-4365 | 1 Gitlab | 1 Gitlab | 2025-04-08 | N/A | 5.5 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.
|
|||||
| CVE-2022-2907 | 1 Gitlab | 1 Gitlab | 2025-04-04 | N/A | 5.7 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link.
|
|||||
| CVE-2022-4054 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 5.5 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
|
|||||
| CVE-2022-3902 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 5.5 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.
|
|||||
| CVE-2022-3820 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 6.5 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.
|
|||||
| CVE-2022-3740 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 6.5 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .
|
|||||
| CVE-2022-3572 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 9.3 CRITICAL |
|
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
|
|||||
| CVE-2022-3478 | 1 Gitlab | 1 Gitlab | 2025-04-02 | N/A | 4.3 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package.
|
|||||
| CVE-2022-4092 | 1 Gitlab | 1 Gitlab | 2025-04-01 | N/A | 5.7 MEDIUM |
|
An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input.
|
|||||
| CVE-2022-4335 | 1 Gitlab | 1 Gitlab | 2025-03-28 | N/A | 4.3 MEDIUM |
|
A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.
|
|||||
| CVE-2022-4205 | 1 Gitlab | 1 Gitlab | 2025-03-27 | N/A | 6.3 MEDIUM |
|
In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
|
|||||
| CVE-2022-4201 | 1 Gitlab | 1 Gitlab | 2025-03-27 | N/A | 3.5 LOW |
|
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
|
|||||
| CVE-2023-0518 | 1 Gitlab | 1 Gitlab | 2025-03-21 | N/A | 4.3 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
|
|||||
| CVE-2022-4138 | 1 Gitlab | 1 Gitlab | 2025-03-21 | N/A | 6.4 MEDIUM |
|
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
|
|||||
| CVE-2022-3759 | 1 Gitlab | 1 Gitlab | 2025-03-21 | N/A | 4.3 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
|
|||||
| CVE-2022-3411 | 1 Gitlab | 1 Gitlab | 2025-03-21 | N/A | 6.5 MEDIUM |
|
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
|
|||||
| CVE-2023-1825 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 3.1 LOW |
|
An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.
|
|||||
| CVE-2023-2030 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 3.5 LOW |
|
An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.
|
|||||
| CVE-2023-2485 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 4.4 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.
|
|||||
| CVE-2023-3362 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 5.3 MEDIUM |
|
An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.
|
|||||
| CVE-2023-3922 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 3.0 LOW |
|
An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.
|
|||||
| CVE-2023-6736 | 1 Gitlab | 1 Gitlab | 2025-03-20 | N/A | 6.5 MEDIUM |
|
An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.
|
|||||
| CVE-2019-6781 | 1 Gitlab | 1 Gitlab | 2025-03-20 | 5.0 MEDIUM | 7.5 HIGH |
|
An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.
|
|||||
| CVE-2025-0555 | 1 Gitlab | 1 Gitlab | 2025-03-07 | N/A | 7.7 HIGH |
|
A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions.
|
|||||
| CVE-2025-0475 | 1 Gitlab | 1 Gitlab | 2025-03-07 | N/A | 8.7 HIGH |
|
An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.
|
|||||
| CVE-2024-8186 | 1 Gitlab | 1 Gitlab | 2025-03-06 | N/A | 5.4 MEDIUM |
|
An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.
|
|||||
| CVE-2022-4331 | 1 Gitlab | 1 Gitlab | 2025-02-28 | N/A | 5.7 MEDIUM |
|
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group.
|
|||||
| CVE-2023-0805 | 1 Gitlab | 1 Gitlab | 2025-02-12 | N/A | 4.9 MEDIUM |
|
An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.
|
|||||
| CVE-2023-0319 | 1 Gitlab | 1 Gitlab | 2025-02-11 | N/A | 5.8 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.
|
|||||
| CVE-2022-3513 | 1 Gitlab | 1 Gitlab | 2025-02-11 | N/A | 6.1 MEDIUM |
|
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
|
|||||