CVE-2022-2428: Improper Neutralization of Input During Web Page Generation

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...

Open redirect

An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL...

CVE-2022-2250: URL Redirection to Untrusted Site

An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL...

CVE-2022-2243: Authorization Bypass Through User-Controlled Key

An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects...

CVE-2022-2244: Undefined Security Weakness

An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature...

CVE-2022-1352: Authorization Bypass Through User-Controlled Key

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that...

CVE-2020-10980

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10979: Undefined Security Weakness

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

CVE-2020-10980: Server-Side Request Forgery (SSRF)

GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration...

CVE-2020-10976: Exposure of Sensitive Information to an Unauthorized Actor

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

CVE-2020-10975: Undefined Security Weakness

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...

CVE-2020-10981: Undefined Security Weakness

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project...

CVE-2020-10978: Undefined Security Weakness

GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API...

CVE-2020-10977: Improper Limitation of a Pathname to a Restricted Directory

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...

CVE-2020-10952: Undefined Security Weakness

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images...

CVE-2020-10955: Missing Authorization

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...