Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
GitLab
HIGH 7.2
In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page
Runner
HIGH 8.8
For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
GitLab
CRITICAL 9.6
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.
GitLab
HIGH 7.1
In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
GitLab
MEDIUM 5.4
In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
GitLab
MEDIUM 5.3
GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
Gitlab Vscode Extension
HIGH 8.6
Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system
GitLab
HIGH 8.8
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unautho…
GitLab
MEDIUM 5.3
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
GitLab
HIGH 8.8
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
GitLab
HIGH 8.1
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1
GitLab
HIGH 7.5
A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
GitLab
HIGH 7.5
A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versio…
GitLab
MEDIUM 6.1
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT req…
GitLab
MEDIUM 5.3
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
GitLab
MEDIUM 6.5
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
GitLab
MEDIUM 5.3
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
GitLab
HIGH 8.8
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on rest…
GitLab
MEDIUM 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later thro…
GitLab
MEDIUM 6.1
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and…
GitLab
MEDIUM 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions…
GitLab
MEDIUM 5.3
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. Thi…
GitLab
MEDIUM 5.3
GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.
GitLab
MEDIUM 5.3
GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.
GitLab
MEDIUM 5.3
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
GitLab
HIGH 7.5
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A…
GitLab
HIGH 7.5
An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposur…
GitLab
MEDIUM 6.5
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.
GitLab
CRITICAL 9.8
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
GitLab
MEDIUM 5.3
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL …