Gitlab

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized use

GitLab through 12.9 is affected by a potential DoS in repository archive download.

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.

GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was cr

GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge

GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or

GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be ta

GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of servic

GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to

GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.

GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was uni

GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,

GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited

GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings

GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vul

GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request t

GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_fe

GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization ch

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public

GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potent

GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribut

GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required

GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scri

GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within

An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable

An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a

An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a res

An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with un

An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of th

An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues,

An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql servi

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded character

An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI wa

An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to

An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were v

An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure thr

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute Jav

An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of inp

An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Serve

An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature con

An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of

An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation.

An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed t

An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the

An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an aut

An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to a

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory e