GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-0244 | 7.5 | Jan 18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5 Affected: 14.5 through 14.5.3; 14.5 through 14.5.3; 14.6 through 14.6.2; 14.6 through 14.6.2 |
| CVE-2021-22170 | 7.5 | Dec 6 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content Affected: 11.6.0 before 13.5.6; 13.6.0 before 13.6.4; 13.7.0 before 13.7.2 |
| CVE-2021-39893 | 7.5 | Oct 5 | A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation Affected: 9.1.0 before 14.1.7; 9.1.0 before 14.1.7; 14.2.0 before 14.2.5; 14.2.0 before 14.2.5; 14.3.0 before 14.3.1; 14.3.0 before 14.3.1 |
| CVE-2021-22229 | 7.5 | Jul 6 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8 Affected: 12.8 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2 |
| CVE-2021-22209 | 7.5 | May 6 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8 Affected: 13.8.0 before 13.9.7; 13.8.0 before 13.9.7; 13.10.0 before 13.10.4; 13.10.0 before 13.10.4; 13.11.0 before 13.11.2; 13.11.0 before 13.11.2 |
| CVE-2021-22200 | 7.5 | Apr 2 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6 Affected: 12.6.0 before 13.8.7; 12.6.0 before 13.8.7; 13.9.0 before 13.9.5; 13.9.0 before 13.9.5; 13.10.0; 13.10.0 |
| CVE-2021-22167 | 7.5 | Jan 15 | An issue has been discovered in GitLab affecting all versions starting from 12.1 Affected: 12.1.0 before 13.5.6; 12.1.0 before 13.5.6; 13.6.0 before 13.6.4; 13.6.0 before 13.6.4; 13.7.0 before 13.7.2; 13.7.0 before 13.7.2 |
| CVE-2021-22166 | 7.5 | Jan 15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method Affected: 13.7.0 before 13.7.2; 13.7.0 before 13.7.2 |
| CVE-2020-13334 | 7.5 | Oct 7 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via… Affected: 8.6.0 before 13.2.10; 8.6.0 before 13.2.10; 13.3.0 before 13.3.7; 13.3.0 before 13.3.7; 13.4.0 before 13.4.2; 13.4.0 before 13.4.2 |
| CVE-2020-13315 | 7.5 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13306 | 7.5 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13274 | 7.5 | Jun 19 | A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1 Affected: before 12.9.8; before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-13273 | 7.5 | Jun 19 | A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 Affected: 12.0.0 before 12.9.8; 12.0.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7 |
| CVE-2020-11506 | 7.5 | Apr 22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2 Affected: 10.7.0 before 12.7.9; 10.7.9 before 12.7.9; 12.8.0 before 12.8.9; 12.8.0 before 12.8.9; 12.9.0 before 12.9.3; 12.9.0 before 12.9.3 |
| CVE-2020-11505 | 7.5 | Apr 22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3 Affected: before 12.7.9; before 12.7.9; 12.8.0 before 12.8.9; 12.8.0 before 12.8.9; 12.9.0 before 12.9.3; 12.9.0 before 12.9.3 |
| CVE-2020-10976 | 7.5 | Apr 8 | GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget Affected: 8.17.0 through 12.9; 8.17.0 through 12.9 |
| CVE-2020-10954 | 7.5 | Mar 27 | GitLab through 12.9 is affected by a potential DoS in repository archive download Affected: through 12.9; through 12.9 |
| CVE-2020-10953 | 7.5 | Mar 27 | In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue Affected: 11.7.0 through 12.9 |
| CVE-2020-10073 | 7.5 | Mar 13 | GitLab EE 12.4.2 through 12.8.1 allows Denial of Service Affected: 12.4.2 through 12.8.1 |
| CVE-2020-10089 | 7.5 | Mar 13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, Affected: 8.11.0 through 12.8.1; 8.11.0 through 12.8.1 |
| CVE-2020-10087 | 7.5 | Mar 13 | GitLab before 12.8.2 allows Information Disclosure Affected: through 12.8.1; through 12.8.1 |
| CVE-2019-13121 | 7.5 | Mar 10 | An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2 Affected: 10.6.0 through 12.0.2 |
| CVE-2019-13003 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3 Affected: before 12.0.3; before 12.0.3 |
| CVE-2019-12446 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11 Affected: 8.3.0 through 11.11.0; 8.3.0 through 11.11.0 |
| CVE-2019-12441 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11 Affected: 8.4.0 through 11.11.0; 8.4.0 through 11.11.0 |
| CVE-2020-8795 | 7.5 | Feb 17 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users Affected: 12.5.0 through 12.7.5 |
| CVE-2020-6833 | 7.5 | Feb 5 | An issue was discovered in GitLab EE 11.3 and later Affected: 11.3.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.2 before 12.7.4 |
| CVE-2020-7978 | 7.5 | Feb 5 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service Affected: 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2020-7972 | 7.5 | Feb 5 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2) Affected: 12.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 before 12.7.4 |
| CVE-2020-7969 | 7.5 | Feb 5 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure Affected: 8.0.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2020-7968 | 7.5 | Feb 5 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control Affected: before 12.5.9; before 12.5.9; 12.6.0 before 12.6.6; 12.6.0 before 12.6.6; 12.7.0 before 12.7.4; 12.7.0 through 12.7.4 |
| CVE-2020-7966 | 7.5 | Feb 5 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal Affected: 11.11.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2019-5472 | 7.5 | Jan 28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments Affected: 11.11.0 before 11.11.6; 11.11.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2 |
| CVE-2019-5470 | 7.5 | Jan 28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability… Affected: 10.8.0 before 11.11.6; 10.8.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2 |
| CVE-2019-15590 | 7.5 | Jan 28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be… Affected: 12.1.0 before 12.1.14; 12.1.0 before 12.1.14; 12.2.0 before 12.2.8; 12.2.0 before 12.2.8; 12.3.0 before 12.3.5; 12.3.0 before 12.3.5 |
| CVE-2019-15583 | 7.5 | Jan 28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) Affected: 12.1.0 before 12.1.12; 12.1.0 before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-19629 | 7.5 | Jan 5 | In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by… Affected: 10.5.0 through 12.3.8; 12.4.0 through 12.4.5; 12.5.0 through 12.5.3 |
| CVE-2019-19314 | 7.5 | Jan 5 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext Affected: 8.4.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2 |
| CVE-2019-19313 | 7.5 | Jan 5 | GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service Affected: 12.3.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2 |
| CVE-2018-20494 | 7.5 | Dec 30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 8.4.0 before 11.4.13; 8.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2019-15576 | 7.5 | Dec 18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-15575 | 7.5 | Dec 18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-18455 | 7.5 | Nov 26 | An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries Affected: 11.0.0 through 12.4.0; 11.0.0 through 12.4.0 |
| CVE-2019-18460 | 7.5 | Nov 26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration Affected: 8.15.0 through 12.4.0; 8.15.0 through 12.4.0 |
| CVE-2019-15729 | 7.5 | Sep 17 | An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1 Affected: 9.0.0 before 12.0.8; 9.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15736 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1 Affected: before 12.0.8; before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15730 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1 Affected: 8.14.0 before 12.0.8; 8.14.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15728 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1 Affected: 10.1.0 before 12.0.8; 10.1.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15725 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1 Affected: 12.0.0 before 12.0.8; 12.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15722 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1 Affected: 8.15.0 before 12.0.8; 8.15.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
The 500 most important CVEs for this product (exploited first, then by severity)