Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to gain control of a GitLab project by importing members from another project that they control. This could allow the attacker to steal data, modify code, or delete the project...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker can read environment names supposed to be restricted to project memebers only...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the explosure of authorization header which allows an attacker to gain access to read authorization headers...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the non-project members can see the default branch name for projects...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists in the SendEntry of the library, which allows an attacker to gain sensitive information through the URL of artifacts stored in object storage with a temporary availability via Rails logs...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper permissions rules allowing an attacker to read confidential Epic references...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because the requirement to enforce 2FA is not honored when using git commands allowing an attacker to perform unauthorized actions...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles invited group members. An attacker can exploit this vulnerability to gain access to a project even if they have not been invited to the project. This can be used to gain access t...

Cross-Site Scripting (XSS)

gitLab is vulnerable to Cross-Site Scripting XSS. This vulnerability occurs due to a flaw in the way that GitLab handles the DataDog integration configuration. An attacker can exploit this vulnerability to inject malicious code into a project's DataDog configuration, which can then be executed by...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists because an attacker can cause uncontrolled resource consumption with a very long issue or merge request description, leading to an application crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability occurs because marshalled session keys were being stored in redis, resulting in Cleartext Storage of Sensitive Information...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This issue allows a member of a private group to validate the use of a specific name for a private project resulting in generation of error message containing sensitive information...

Arbitrary Code Execution

gitlab is vulnerable to Arbitrary Code Execution. An attacker can inject and execute malicious code on server...

Uncontrolled Resource Consumption

gitlab is vulnerable to Uncontrolled Resource Consumption. This allows a malicious attacker to create a recursive pipeline relation resulting in them being able to exhaust resources...

Uncontrolled Resource Consumption

gitlab is vulnerable to Uncontrolled Resource Consumption. Thie allows a malicious attacker to spike the server resource utilization resulting in a potential denial of service...

UBUNTU-CVE-2023-3994

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use...

CVE-2023-0632

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions prior to 16.0.8, 16.1....

CVE-2023-3385

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

The vulnerability of GitLab’s repository management system, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code.

The vulnerability of Gitlab’s repository management system is related to the lack of measures taken to protect the structure of the web interface. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...