GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-1733 | 7.5 | Apr 5 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1 Affected: 11.10.0 before 15.8.5; 11.10.0 before 15.8.5; 15.9.0 before 15.9.4; 15.9.0 before 15.9.4; 15.10.0; 15.10.0 |
| CVE-2023-0518 | 7.5 | Feb 13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from… Affected: 14.0 before 15.6.7; 14.0 before 15.6.7; 15.7 before 15.7.6; 15.7 before 15.7.6; 15.8 before 15.8.1; 15.8 before 15.8.1 |
| CVE-2022-3759 | 7.5 | Feb 13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from… Affected: 14.3 before 15.6.7; 14.3 before 15.6.7; 15.7 before 15.7.6; 15.7 before 15.7.6; 15.8 before 15.8.1; 15.8 before 15.8.1 |
| CVE-2022-4205 | 7.5 | Jan 27 | In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash Affected: 1.0.0 before 12.9.8; 1.0.0 before 12.9.8; 15.5.0 before 15.5.5; 15.5.0 before 15.5.5; 15.6.0; 15.6.0 |
| CVE-2022-4167 | 7.5 | Jan 12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue… Affected: 13.11.0 before 15.5.7; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2 |
| CVE-2022-3613 | 7.5 | Jan 12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2 Affected: before 15.5.7; before 15.5.7; 15.6.0 before 15.6.4; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2; 15.7.0 before 15.7.2 |
| CVE-2022-3285 | 7.5 | Nov 9 | Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to… Affected: 12.0.0 before 15.2.5; 12.0.0 before 15.2.5; 15.3.0 before 15.3.4; 15.3.0 before 15.3.4; 15.4.0; 15.4.0 |
| CVE-2022-3639 | 7.5 | Oct 21 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting… Affected: >=10.8, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2022-3031 | 7.5 | Oct 17 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 Affected: >=15.3, <15.3.2; >=15.2, <15.2.4; >=0.0, <15.1.6 |
| CVE-2022-2931 | 7.5 | Oct 17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3… Affected: <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2022-3283 | 7.5 | Oct 17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from… Affected: >=15.4, <15.4.1; >=15.3, <15.3.4; <15.2.5 |
| CVE-2022-2501 | 7.5 | Aug 5 | An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP… Affected: >=12.0, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-2498 | 7.5 | Aug 5 | An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the… Affected: >=12.8, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-2229 | 7.5 | Jul 1 | An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the… Affected: 13.7.0 before 14.10.5; 13.7.0 before 14.10.5; 15.0.0 before 15.0.4; 15.0.0 before 15.0.4; 15.1.0; 15.1.0 |
| CVE-2022-1413 | 7.5 | May 19 | Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before… Affected: 1.0.2 before 14.8.6; 1.0.2 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-1510 | 7.5 | May 11 | An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10… Affected: 13.9.0 before 14.8.6; 13.9.0 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-1174 | 7.5 | Apr 4 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before… Affected: 13.7.0 before 14.7.7; 13.7.0 before 14.7.7; 14.8.0 before 14.8.5; 14.8.0 before 14.8.5; 14.9.0 before 14.9.2; 14.9.0 before 14.9.2 |
| CVE-2022-0741 | 7.5 | Apr 1 | Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses Affected: 10.0.0 before 14.6.5; 10.0.0 before 14.6.5; 14.7.0 before 14.7.4; 14.7.0 before 14.7.4; 14.8.0 before 14.8.2; 14.8.0 before 14.8.2 |
| CVE-2021-39908 | 7.5 | Apr 1 | In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode… Affected: 0.8.0 before 14.2.6; 0.8.0 before 14.2.6; 14.3.0 before 14.3.4; 14.3.0 before 14.3.4; 14.4.0; 14.4.0 |
| CVE-2022-0738 | 7.5 | Mar 28 | An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8… Affected: 10.0 before 14.6.5; 10.0 before 14.6.5; 14.7 before 14.7.4; 14.7 before 14.7.4; 14.8 before 14.8.2; 14.8 before 14.8.2 |
| CVE-2022-0244 | 7.5 | Jan 18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5 Affected: 14.5 through 14.5.3; 14.5 through 14.5.3; 14.6 through 14.6.2; 14.6 through 14.6.2 |
| CVE-2021-22170 | 7.5 | Dec 6 | Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content Affected: 11.6.0 before 13.5.6; 13.6.0 before 13.6.4; 13.7.0 before 13.7.2 |
| CVE-2021-39893 | 7.5 | Oct 5 | A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation Affected: 9.1.0 before 14.1.7; 9.1.0 before 14.1.7; 14.2.0 before 14.2.5; 14.2.0 before 14.2.5; 14.3.0 before 14.3.1; 14.3.0 before 14.3.1 |
| CVE-2021-22229 | 7.5 | Jul 6 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8 Affected: 12.8 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2 |
| CVE-2021-22209 | 7.5 | May 6 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8 Affected: 13.8.0 before 13.9.7; 13.8.0 before 13.9.7; 13.10.0 before 13.10.4; 13.10.0 before 13.10.4; 13.11.0 before 13.11.2; 13.11.0 before 13.11.2 |
| CVE-2021-22200 | 7.5 | Apr 2 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6 Affected: 12.6.0 before 13.8.7; 12.6.0 before 13.8.7; 13.9.0 before 13.9.5; 13.9.0 before 13.9.5; 13.10.0; 13.10.0 |
| CVE-2021-22167 | 7.5 | Jan 15 | An issue has been discovered in GitLab affecting all versions starting from 12.1 Affected: 12.1.0 before 13.5.6; 12.1.0 before 13.5.6; 13.6.0 before 13.6.4; 13.6.0 before 13.6.4; 13.7.0 before 13.7.2; 13.7.0 before 13.7.2 |
| CVE-2021-22166 | 7.5 | Jan 15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method Affected: 13.7.0 before 13.7.2; 13.7.0 before 13.7.2 |
| CVE-2020-13334 | 7.5 | Oct 7 | In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via… Affected: 8.6.0 before 13.2.10; 8.6.0 before 13.2.10; 13.3.0 before 13.3.7; 13.3.0 before 13.3.7; 13.4.0 before 13.4.2; 13.4.0 before 13.4.2 |
| CVE-2020-13315 | 7.5 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13306 | 7.5 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13274 | 7.5 | Jun 19 | A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1 Affected: before 12.9.8; before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-13273 | 7.5 | Jun 19 | A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 Affected: 12.0.0 before 12.9.8; 12.0.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7 |
| CVE-2020-11506 | 7.5 | Apr 22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2 Affected: 10.7.0 before 12.7.9; 10.7.9 before 12.7.9; 12.8.0 before 12.8.9; 12.8.0 before 12.8.9; 12.9.0 before 12.9.3; 12.9.0 before 12.9.3 |
| CVE-2020-11505 | 7.5 | Apr 22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3 Affected: before 12.7.9; before 12.7.9; 12.8.0 before 12.8.9; 12.8.0 before 12.8.9; 12.9.0 before 12.9.3; 12.9.0 before 12.9.3 |
| CVE-2020-10976 | 7.5 | Apr 8 | GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget Affected: 8.17.0 through 12.9; 8.17.0 through 12.9 |
| CVE-2020-10954 | 7.5 | Mar 27 | GitLab through 12.9 is affected by a potential DoS in repository archive download Affected: through 12.9; through 12.9 |
| CVE-2020-10953 | 7.5 | Mar 27 | In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue Affected: 11.7.0 through 12.9 |
| CVE-2020-10073 | 7.5 | Mar 13 | GitLab EE 12.4.2 through 12.8.1 allows Denial of Service Affected: 12.4.2 through 12.8.1 |
| CVE-2020-10089 | 7.5 | Mar 13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, Affected: 8.11.0 through 12.8.1; 8.11.0 through 12.8.1 |
| CVE-2020-10087 | 7.5 | Mar 13 | GitLab before 12.8.2 allows Information Disclosure Affected: through 12.8.1; through 12.8.1 |
| CVE-2019-13121 | 7.5 | Mar 10 | An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2 Affected: 10.6.0 through 12.0.2 |
| CVE-2019-13003 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3 Affected: before 12.0.3; before 12.0.3 |
| CVE-2019-12446 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11 Affected: 8.3.0 through 11.11.0; 8.3.0 through 11.11.0 |
| CVE-2019-12441 | 7.5 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11 Affected: 8.4.0 through 11.11.0; 8.4.0 through 11.11.0 |
| CVE-2020-8795 | 7.5 | Feb 17 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users Affected: 12.5.0 through 12.7.5 |
| CVE-2020-6833 | 7.5 | Feb 5 | An issue was discovered in GitLab EE 11.3 and later Affected: 11.3.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.2 before 12.7.4 |
| CVE-2020-7978 | 7.5 | Feb 5 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service Affected: 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2020-7972 | 7.5 | Feb 5 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2) Affected: 12.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 before 12.7.4 |
| CVE-2020-7969 | 7.5 | Feb 5 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure Affected: 8.0.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
The 500 most important CVEs for this product (exploited first, then by severity)