CVE-2021-39934

Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2...

CVE-2021-39919

Removed by vendor...

CVE-2021-39919

CVE-2021-39919 affects GitLab CE/EE: vulnerable in all versions before 14.3.6, all versions from 14.4 before 14.4.4, and all versions from 14.5 before 14.5.2. The reset password token and new user email token are logged, risking information disclosure. Remediation is to upgrade to fixed releases ...

CVE-2021-39915

CVE-2021-39915: GitLab CE/EE GraphQL API has improper access control that lets an attacker view the names of project access tokens on arbitrary projects. Affected: GitLab versions starting from 13.0 up to before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2. Remediation per sources is to upg...

CVE-2021-39933

Removed by vendor...

CVE-2021-39933

CVE-2021-39933 affects GitLab CE/EE: all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. An input handling regex (notes, comments, etc) is vulnerable to catastrophic backtracking, enabling a denial of se...

CVE-2021-39938

Removed by vendor...

CVE-2021-39938

CVE-2021-39938 : A vulnerable regular expression in GitLab CE/EE allows DoS via specially crafted deploy slash commands. Affected versions: GitLab CE/EE 8.15 before 14.3.6; starting from 14.4 before 14.4.4; starting from 14.5 before 14.5.2. Remediation available by upgrading to patched releases (...

CVE-2021-39936

CVE-2021-39936 affects GitLab CE/EE: improper access control allows an attacker with a deploy token to access a project’s disabled wiki. Affected versions include 10.7–14.3.6, 14.4–14.4.3, and 14.5–14.5.1. The issue is caused by insufficient access checks on wiki access via deploy tokens. Public ...

CVE-2021-39931

GitLab CE/EE CVE-2021-39931 affects all versions from 8.11 up to 14.3.6, and 14.4 up to 14.4.4, and 14.5 up to 14.5.2. The flaw is a business-logic error that allowed an unauthorized project member to delete a protected branch. Impact described in the sources involves unauthorized deletion by low...

CVE-2021-39945

Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project...

CVE-2021-39945

CVE-2021-39945 affects GitLab CE/EE API. A bug in access control allows an author of a Merge Request to approve the MR even after their project access is revoked, across GitLab versions: 9.4–14.3.6, 14.4–14.4.3, and 14.5–14.5.1. Root cause is improper access restriction in the Merge Request appro...

CVE-2021-39944

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege ...

CVE-2021-39944

CVE-2021-39944 affects GitLab CE/EE: multiple branches of affected versions, specifically 11.0–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1. The root cause is a permissions validation flaw that lets group members with a developer role elevate to maintainer on imported projects. Practical impact: priv...

CVE-2021-39940

Removed by vendor...

CVE-2021-39940

CVE-2021-39940 affects GitLab CE/EE and specifically the GitLab Maven Package registry. Versions 13.2–13.? (starting 13.2) up to but not including 14.3.6, 14.4 up to but not including 14.4.4, and 14.5 up to but not including 14.5.2 are vulnerable. The issue is a regular expression denial of servi...

CVE-2021-39910

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

CVE-2021-39910

GitLab CE/EE versions affected by CVE-2021-39910 are vulnerable to HTML Injection via the Swagger UI feature. Specifically, GitLab installations with: 12.6–14.3.5, 14.4.0–14.4.3, and 14.5.0–14.5.1 are impacted. The root cause is HTML injection through Swagger UI as described in the CVE, with impa...

Exploit for Code Injection in Gitlab

Golang-CVE-2021-22205-POC A bare bones CVE-2021-22205 Gitlab R...

GitLab < 13.8.8, 13.9.x < 13.9.6, 13.10.x < 13.10.3 RCE Vulnerability - Active Check

GitLab is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...