← Back

Gitlab

gitlab

1,511 CVEs • 11 products

Products (11)

Click to collapse
Toggle
Gitlab
gitlab
1,496 CVEs
Gitlab Shell
gitlab-shell
5 CVEs
Dynamic Application Security Testing Analyzer
dynamic_application_security_testing_analyzer
4 CVEs
Runner
runner
3 CVEs
Gitlab Vscode Extension
gitlab-vscode-extension
2 CVEs
Omnibus
omnibus
1 CVE
Gitaly
gitaly
1 CVE
Gitlab Runner
gitlab_runner
1 CVE
Dast Api Scanner
dast_api_scanner
1 CVE
\
1 CVE
Language Server
language_server
1 CVE

CVEs (1,511)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-39903
1Gitlab
1Gitlab
Jun 17, 2026
Nov 4, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that v...Show more
In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings.Show less
CVE-2021-39902
1Gitlab
1Gitlab
Jun 17, 2026
Nov 4, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.
CVE-2021-22263
1Gitlab
1Gitlab
Jun 17, 2026
Oct 11, 2021
N/A· v4
6.5 MEDIUM· v3
5.5 MEDIUM· v2
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external'...Show more
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects.Show less
CVE-2021-39880
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 bef...Show more
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.Show less
CVE-2021-39891
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure.
CVE-2021-39889
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of...Show more
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.Show less
CVE-2021-39886
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
CVE-2021-39881
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
3.5 LOW· v3
3.5 LOW· v2
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to...Show more
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.Show less
CVE-2021-39870
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.
CVE-2021-22264
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions,...Show more
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted.Show less
CVE-2021-22262
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 with Jira Cloud integration enabled allows...Show more
Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration pageShow less
CVE-2021-22261
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2....Show more
A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responsesShow less
CVE-2021-22258
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
CVE-2021-22257
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is no...Show more
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances.Show less
CVE-2021-39894
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks.
CVE-2021-39893
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.
CVE-2021-39888
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 a specific API endpoint may reveal details about a private...Show more
In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 a specific API endpoint may reveal details about a private group and other sensitive info inside issue and merge request templates.Show less
CVE-2021-39884
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileged users that are part of that project.
CVE-2021-39882
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.
CVE-2021-39878
1Gitlab
1Gitlab
Jun 17, 2026
Oct 5, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javascript code.