Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. This vulnerability allows an attacker to cause a DoS attack on a GitLab instance by exploiting a regex issue in how the application parses user agents...

CVE-2022-3514

An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the...

GitLab: XSS in ZenTao integration affecting self hosted instances without strict CSP

Summary The ZenTao issue integration premium feature is susceptible to an XSS attack by delivering modified API responses to GitLab. This is related and similar to my report https://hackerone.com/reports/1533976 but this time affecting the ZenTao integration. A user can create a project and...

CVE-2019-5461

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

Input validation

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2017-0920

CVE-2017-0920 affects GitLab CE/EE before 10.1.6, 10.2.6, and 10.3.4. The root cause is an authorization bypass in the Projects::MergeRequests::CreationsController, allowing an attacker to view the name of every project and its namespace on the GitLab instance. The impact is information disclosur...

GitLab: Every user can delete public deploy keys

Vulnerability details A GitLab instance can have public deploy keys that project admins can use for their project. An attacker can delete these public keys used by other users to deploy code. Impact Deleting these shared deploy keys may stop users to deploy their code. Proof of concept Make sure...