← Back

Gitlab

gitlab

1,511 CVEs • 11 products

Products (11)

Click to collapse
Toggle
Gitlab
gitlab
1,496 CVEs
Gitlab Shell
gitlab-shell
5 CVEs
Dynamic Application Security Testing Analyzer
dynamic_application_security_testing_analyzer
4 CVEs
Runner
runner
3 CVEs
Gitlab Vscode Extension
gitlab-vscode-extension
2 CVEs
Omnibus
omnibus
1 CVE
Gitaly
gitaly
1 CVE
Gitlab Runner
gitlab_runner
1 CVE
Dast Api Scanner
dast_api_scanner
1 CVE
\
1 CVE
Language Server
language_server
1 CVE

CVEs (1,511)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-8971
2Debian
Gitlab
2Debian Linux
Gitlab
Jun 17, 2026
Mar 24, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users.
CVE-2017-0920
1Gitlab
1Gitlab
Nov 21, 2024
Mar 22, 2018
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see eve...Show more
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.Show less
CVE-2018-3710
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution.
CVE-2017-0927
1Gitlab
1Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.
CVE-2017-0926
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.
CVE-2017-0925
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
7.2 HIGH· v3
4.0 MEDIUM· v2
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
CVE-2017-0924
1Gitlab
1Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.
CVE-2017-0923
1Gitlab
1Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
CVE-2017-0922
1Gitlab
1Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.
CVE-2017-0918
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution.
CVE-2017-0917
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
CVE-2017-0916
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution.
CVE-2017-0915
2Debian
Gitlab
2Debian Linux
Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution.
CVE-2017-0914
1Gitlab
1Gitlab
Nov 21, 2024
Mar 21, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database.
CVE-2014-8540
1Gitlab
1Gitlab
Nov 21, 2024
Jan 5, 2018
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
CVE-2017-17716
1Gitlab
1Gitlab
May 13, 2026
Dec 17, 2017
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is...Show more
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.Show less
CVE-2017-12426
1Gitlab
1Gitlab
May 13, 2026
Aug 14, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute...Show more
GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.Show less
CVE-2017-11438
1Gitlab
1Gitlab
May 13, 2026
Aug 2, 2017
N/A· v4
6.3 MEDIUM· v3
6.5 MEDIUM· v2
GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.
CVE-2017-11437
1Gitlab
1Gitlab
May 13, 2026
Aug 2, 2017
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to o...Show more
GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.Show less
CVE-2017-8778
1Gitlab
1Gitlab
May 13, 2026
May 4, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.