CVE-2021-22201

GitLab CE/EE CVE-2021-22201 affects all versions from 13.9. A crafted import file could read files on the server (arbitrary file read) during project import/export. Public details in the sources indicate affected ranges such as 13.9.x before 13.9.5 and 13.10.x before 13.10.1; remediation mentione...

CVE-2021-22203

Removed by vendor...

CVE-2021-22203

CVE-2021-22203 affects GitLab CE/EE; a specially crafted Wiki page could read arbitrary files on the server. Affected versions: 13.7.9–13.8.6, 13.9.x before 13.9.5, and 13.10.x before 13.10.1. Remediation: upgrade to patched releases (e.g., 13.8.7, 13.9.5, 13.10.1 or newer). Root cause: Wiki hand...

CVE-2021-22203

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting from 13.10 before 13.10.1. A specially crafted Wiki page allowed attackers to read arbitrary files on the server...

CVE-2021-22196

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name...

CVE-2021-22196

CVE-2021-22196 affects GitLab CE/EE starting from version 13.4 and later. The issue is a stored cross-site scripting vulnerability exploited via a specially crafted branch name in merge requests. Exploitation details and impact are described in the linked sources; remediation information (patch v...

PT-2021-14907 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.4 and later Description: An issue has been discovered in GitLab CE/EE, where it was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name. Recommendations: For GitLa...

CVE-2021-22177

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command...

CVE-2021-22177

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command...

CVE-2021-22177

Removed by vendor...

CVE-2021-22177

Summary of CVE-2021-22177 (GitLab/gitlab-shell DoS) Affected software: GitLab Community Edition and Enterprise Edition (GitLab CE/EE) with gitlab-shell, version 12.6.0 or newer. Root cause and vulnerability: A potential DoS vulnerability in gitlab-shell allows an attacker to spike server resource...

Vulnerabilities fixed in GitLab

Several vulnerabilities have been fixed in GitLab Community Edition CE and Enterprise Edition EE. The vulnerabilities allow a remote unauthenticated malicious person potentially able to perform attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF Cross-Site...

GitLab CE/EE Code Injection Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A code...

CVE-2021-22192

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server...

CVE-2021-22186

An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners...

Authorization

An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners...

CVE-2021-22186

CVE-2021-22186 is an authorization issue in GitLab CE/EE, affecting versions 9.4 and later. Affected component: group-level CI/CD variables configuration; root cause described as a permission flaw that allows a group maintainer to modify variables that should be restricted to group owners . Docum...

CVE-2021-22186

Removed by vendor...

CVE-2021-22192

CVE-2021-22192 affects GitLab CE/EE (from version 13.2 onward): an authenticated user can execute arbitrary code on the server due to unsafe/unsupported markdown rendering. Public sources describe RCE via user-controlled Markdown rendering options; OSS and security advisories confirm the vulnerab...

Gitlab CE/EE Trust Management Issue Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A trust management issue vulnerability exists in Gitlab...