CVE-2021-22181

A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources...

Denial of service

A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources...

CVE-2021-22181

Removed by vendor...

CVE-2021-22181

CVE-2021-22181 affects GitLab CE/EE, with a denial-of-service risk due to a vulnerability that lets an attacker create a recursive pipeline relationship and exhaust resources in versions dating back to 11.8. Multiple connected sources (OSV, Arch Linux advisory) confirm the issue and point to upst...

CVE-2021-22216

CVE-2021-22216 is a denial-of-service vulnerability in GitLab CE/EE that affects all versions prior to 13.12.2, 13.11.5, or 13.10.5. An attacker can cause uncontrolled resource consumption by supplying a very long issue or merge request description, potentially exhausting server resources. The is...

CVE-2021-22217

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request...

CVE-2021-22213

A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari...

Information disclosure

All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 allow a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly...

CVE-2021-22217

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request...

CVE-2021-22219

CVE-2021-22219 – GitLab information disclosure : GitLab CE/EE versions affected are 9.5–13.12.1 (with specific end versions: before 13.10.5, before 13.11.5, and before 13.12.2). The issue allows a high-privilege user to obtain sensitive information from log files because sensitive data was not pr...

CVE-2021-22217

GitLab CE/EE is affected by a denial-of-service vulnerability (CVE-2021-22217) in all versions before 13.12.2, 13.11.5, or 13.10.5. An attacker can trigger uncontrolled resource consumption by submitting a specially crafted issue or merge request, leading to high CPU/disk/resource usage on vulner...

CVE-2021-22215

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects...

CVE-2021-22218

All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits...

Information disclosure

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects...

CVE-2021-22218

All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits...

CVE-2021-22214

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited...

CVE-2021-22215

Removed by vendor...

CVE-2021-22218

GitLab CE/EE versions affected by CVE-2021-22218 include 12.8 before 13.10.5, all 13.11 versions before 13.11.5, and all 13.12 versions before 13.12.2, due to an issue in handling x509 certificates that could be used to spoof the author of signed commits. The root cause is improper x509 handling ...

CVE-2021-22214

Removed by vendor...

CVE-2021-22214

GitLab CE/EE 10.5+ is affected by a server-side request forgery when requests to the internal network for webhooks are enabled. The SSRF can be exploited by an unauthenticated attacker on instances with limited registration. The issue spans multiple CVEs and has been addressed in patches across s...