Skip to contentGitlab vulnerabilities
Newest
- gitlabClient-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1...CVE-2020-13262Fix available6.1 Medium
- gitlabA user with an unverified email address could request an access to domain restricted groups in...CVE-2020-13275Fix available8.0 High
- gitlabA security issue allowed achieving Denial of Service attacks through memory exhaustion by...CVE-2020-13274Fix available7.5 High
- gitlabA Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0...CVE-2020-13273Fix available7.5 High
- gitlabUser email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to...CVE-2020-13265Fix available4.3 Medium
- gitlabOAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user...CVE-2020-13272Fix available7.5 High
- gitlabUser is allowed to set an email as a notification email even without verifying the new email in...CVE-2020-13276Fix available7.4 High
- gitlabAn authorization issue in the mirroring logic allowed read access to private repositories in...CVE-2020-13277Public exploitFix available6.3 Medium
- pcre, apple macos, gitlab +12 more +14 morelibpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.CVE-2020-14155Fix available5.3 Medium
- gitlabA Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code...CVE-2020-13269Fix available6.1 Medium
- gitlabMissing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1...CVE-2020-13270Fix available7.5 High
- gitlabA specially crafted request could be used to confirm the existence of files hosted on object...CVE-2020-13268Fix available5.3 Medium
- gitlabA Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the...CVE-2020-13267Fix available6.1 Medium
- gitlabA Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in...CVE-2020-13271Fix available6.1 Medium
- gitlabInsecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1...CVE-2020-13266Fix available4.3 Medium
- gitlabGitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via...CVE-2020-12448Fix available5.3 Medium
- gitlabGitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to...CVE-2020-12275Fix available5.3 Medium
- gitlabGitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.CVE-2020-12276Fix available4.8 Medium
- gitlabGitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if...CVE-2020-12277Fix available5.3 Medium
- gitlabAn issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still...CVE-2020-11649Fix available6.5 Medium
- gitlabAn issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead...CVE-2020-11506Fix available7.5 High
- gitlabAn issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7...CVE-2020-11505Fix available7.5 High
- gitlabGitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized...CVE-2020-10975Fix available4.3 Medium
- gitlabGitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.CVE-2020-10976Fix available7.5 High
- gitlabGitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.CVE-2020-10977Public exploitFix availableEPSS 42.7%5.5 Medium
- gitlabGitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then...CVE-2020-10978Fix available5.3 Medium
- gitlabGitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to...CVE-2020-10979Fix available4.3 Medium
- gitlabGitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.CVE-2020-10980Fix available9.8 Critical
- gitlabGitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger...CVE-2020-10981Fix available4.3 Medium
- gitlabGitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.CVE-2020-10952Fix available6.5 Medium
- gitlabIn GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.CVE-2020-10953Fix available7.5 High
- gitlabGitLab through 12.9 is affected by a potential DoS in repository archive download.CVE-2020-10954Fix available7.5 High
- gitlab, debian linux +1 moreGitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that...CVE-2020-10955Fix available6.5 Medium
- gitlabGitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.CVE-2020-10956Fix available9.8 Critical
- gitlabGitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a...CVE-2020-10073Fix available7.5 High
- gitlabGitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a...CVE-2020-10074Fix available9.8 Critical
- gitlabGitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially...CVE-2020-10075Fix available6.1 Medium
- gitlabGitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered...CVE-2020-10076Fix available6.1 Medium
- gitlabGitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular...CVE-2020-10077Fix available9.8 Critical
- gitlabGitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a...CVE-2020-10078Fix available6.1 Medium
- gitlabGitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users...CVE-2020-10079Fix available5.3 Medium
- gitlabGitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members...CVE-2020-10080Fix available5.3 Medium
- gitlabGitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS...CVE-2020-10081Fix available6.5 Medium
- gitlabGitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting...CVE-2020-10082Fix available5.3 Medium
- gitlabGitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups,...CVE-2020-10083Fix available9.1 Critical
- gitlabGitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request...CVE-2020-10084Fix available5.3 Medium
- gitlabGitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge...CVE-2020-10085Fix available5.3 Medium
- gitlabGitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a...CVE-2020-10086Fix available5.3 Medium
- gitlabGitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing...CVE-2020-10087Fix available7.5 High
- gitlabGitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it...CVE-2020-10088Fix available8.1 High
- Show moreLoading…