Browse CVEs

HIGH 8.8 CVE-2020-13296 An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tok… GitLab 13.0.14 / 13.1.8+ Fix from $1,9502020-09-30 HIGH 8.3 CVE-2020-13321 A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added. GitLab 12.10.13 / 13.0.8+ Fix from $1,9502020-09-30 HIGH 7.7 CVE-2020-13323 A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos GitLab 12.10.13 / 13.0.8+ Fix from $1,9502020-09-30 HIGH 7.2 CVE-2020-13322 A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete… GitLab 12.10.13 / 13.0.8+ Fix from $1,9502020-09-30 HIGH 7.1 CVE-2020-13325 A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, pote… GitLab 12.10.13 / 13.0.8+ Fix from $1,9502020-09-30 MEDIUM 6.5 CVE-2020-13320 An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security da… GitLab 12.10.13+ Fix from $1,6002020-09-30 MEDIUM 6.5 CVE-2020-13324 A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API. GitLab 12.10.13 / 13.0.8+ Fix from $1,6002020-09-30 MEDIUM 6.5 CVE-2020-13329 An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view fe… GitLab 12.6.2 / 12.10.13+ Fix from $1,6002020-09-30 MEDIUM 5.4 CVE-2020-13330 An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project fe… GitLab 12.10.13+ Fix from $1,6002020-09-30 MEDIUM 6.5 CVE-2020-13303 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized use… GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-15 HIGH 8.8 CVE-2020-13309 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the reposit… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 HIGH 7.5 CVE-2020-13306 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of serv… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 HIGH 7.5 CVE-2020-13315 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of resu… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 HIGH 7.2 CVE-2020-13304 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which res… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 MEDIUM 6.5 CVE-2020-13310 A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by… GitLab 13.1.3 / 13.2.3+ Fix from $1,6002020-09-14 HIGH 7.2 CVE-2020-13302 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user s… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 MEDIUM 5.8 CVE-2020-13298 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating t… GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-14 MEDIUM 5.4 CVE-2020-13297 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious… GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-14 CRITICAL 9.8 CVE-2020-13312 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks thro… GitLab 13.1.10 / 13.2.8+ Fix from $2,3002020-09-14 MEDIUM 5.3 CVE-2020-13314 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit cont… GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-14 HIGH 7.3 CVE-2020-13318 A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-accou… GitLab 13.0.12 / 13.1.10+ Fix from $1,9502020-09-14 CRITICAL 10.0 CVE-2020-13300 GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorizati… GitLab 13.3.4+ Fix from $2,3002020-09-14 HIGH 8.1 CVE-2020-13299 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and o… GitLab 13.1.10 / 13.2.8+ Fix from $1,9502020-09-14 MEDIUM 6.5 CVE-2020-13284 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-14 MEDIUM 5.4 CVE-2020-13289 A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA … GitLab 13.1.10 / 13.2.8+ Fix from $1,6002020-09-14 MEDIUM 6.5 CVE-2020-13281 For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature GitLab 13.0.12 / 13.1.6+ Fix from $1,6002020-08-13 MEDIUM 5.4 CVE-2020-13285 For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. GitLab 13.0.12 / 13.1.6+ Fix from $1,6002020-08-13 MEDIUM 6.5 CVE-2020-13280 For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. GitLab 13.0.12 / 13.1.6+ Fix from $1,6002020-08-13 MEDIUM 5.4 CVE-2020-13283 For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. GitLab 13.0.12 / 13.1.6+ Fix from $1,6002020-08-13 HIGH 8.1 CVE-2020-13291 In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. GitLab 13.2.3+ Fix from $1,9502020-08-12