CVE-2021-22250

Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account...

CVE-2021-22236

Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1...

CVE-2021-22242

CVE-2021-22242 affects GitLab CE/EE versions 11.4 and later, due to insufficient input sanitization in Mermaid markdown, enabling stored cross-site scripting when processing crafted Markdown. The issue is consistently documented across NVD, OSV, and vendor/Tenable reports (GitLab CVE entry and OS...

CVE-2021-22243

GitLab CVE-2021-22243 affects GitLab CE/EE versions starting 7.10, where under specialized conditions an invite URL intended for a different email address can be used by an existing GitLab user to gain access to a group. The connected Red Hat and OSV entries corroborate the basic description; how...

CVE-2021-22244

Removed by vendor...

CVE-2021-22244

CVE-2021-22244 concerns an improper authorization flaw in GitLab EE’s vulnerability report feature, allowing a reporter to access vulnerability data. Affected: GitLab Enterprise Edition, versions since 13.1. Root cause: improper authorization. Impact: leakage of vulnerability data to reporters; n...

CVE-2021-22247

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22247

The CVE concerns GitLab CE/EE (all versions since 13.0) with improper authorization that allows guests in private projects to view CI/CD analytics. Multiple connected sources (e.g., Red Hat CVE page, OSV, NVD, and OSV Ubuntu/NASL references) corroborate the issue. The root cause details beyond “i...

CVE-2021-22247

Removed by vendor...

CVE-2021-22245

CVE-2021-22245 affects GitLab CE/EE (all versions) due to improper validation of the commit author. The flaw allows an attacker to make several pages in a project impossible to view. Documents consistently describe the issue but do not provide specific exploit vectors, affected exact versions, or...

CVE-2021-22256

Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status...

CVE-2021-22256

Removed by vendor...

CVE-2021-22256

CVE-2021-22256 concerns GitLab CE/EE: improper authorization allowed guest users to create issues for Sentry errors and track status, affecting all versions since 12.6. Public records from Red Hat, OSV, NVD and related feeds confirm the issue exists in GitLab CE/EE and has concrete exploitation c...

CVE-2021-22250

Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account...

CVE-2021-22250

CVE-2021-22250: Improper authorization in GitLab CE/EE affecting all versions since 13.3 allows users to view and delete impersonation tokens created for their account. The data provided does not specify concrete exploit vectors, affected components beyond the impersonation token mechanism, or re...

CVE-2021-22242: Improper Neutralization of Input During Web Page Generation

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown...

CVE-2021-22236: Incorrect Authorization

Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1...

CVE-2021-22245: Improper Input Validation

Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view...

CVE-2021-22247: Incorrect Authorization

Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics...

CVE-2021-22244: Undefined Security Weakness

Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data...