Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists due to the uncontrolled resource consumption in the library, allowing an attacker to cause an application crash by deploying maliciously crafted slash commands...

Improper Access Control

gitlab is vulnerable to Improper Access Control. An attacker could exploit this vulnerability to access a project's disabled wiki, even if they do not have the necessary permissions. This could allow the attacker to view or modify the wiki's contents, or to gain access to sensitive data that may ...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists because the low-privileged users can bypass the file size limits in the NPM package repository...

Improper Privilege Management

Gitlab is vulnerable to Improper Privilege Management. The vulnerability is due to flowed permission validation which allowed group members with a developer role to elevate their privilege to a maintainer on projects they import...

Improper Access Control

gitlab is vulnerable to Improper Access Control. An attacker could exploit this vulnerability to approve a Merge Request for a project that they no longer have access to. This could allow the attacker to introduce malicious code into the project, or to gain unauthorized access to sensitive data...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to update the status of an external status check to "success", even if the check has failed. This could cause GitLab to deploy code or release a package that is not ready, which could lead to security...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the non-project members can see the default branch name for projects...

Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the Maven Package registry, allowing an attacker to cause an application crash by sending a maliciously crafted string...

Server-Side Request Forgery

gitlab is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists because the shared address spaces are not blocked for requests, allowing an attacker to cause blind SSRF attacks...

Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial Of Service ReDoS. An attacker can cause an application crash by submitting a maliciously crafted input...

Business Logic Flaws

GitLab is vulnerable to Business Logic Flaws. The vulnerability exists under specific conditions, which allows an unauthorised project members to delete a protected branches...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS. An attacker could exploit this vulnerability to access a user's custom project and group templates, which could then be used to create new projects and groups, or to modify existing projects and groups. This could allow an attacker to gain unauthoriz...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to obtain the service desk email address for a GitLab project. This could then be used to contact the service desk impersonating a project member, or to send phishing emails to project members. This could...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to access a user's custom project and group templates, which could then be used to create new projects and groups, or to modify existing projects and groups...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to obtain the reset password token and new user email token for a GitLab user. This could then be used to reset the user's password or create a new account in their name...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS. An attacker could exploit this vulnerability to send a specially crafted GitLab quick action request that could cause the GitLab server to consume excessive CPU resources, leading to a DoS attack...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability occurs due to a lack of access control allowing authenticated users to retrieve configurations of any external status checks...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to add malicious comments to vulnerabilities, which could then be seen by other users. These malicious comments could contain misinformation or phishing links, which could be used to deceive users and...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the insertion of sensitive information into log file which allows an attacker with local file system access to obtain system root-level privileges...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to obtain the names of project access tokens, which could then be used to access and modify GitLab projects...

Regular Expression Denial Of Service (ReDoS)

gitlab is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists because the library causes excessive usage of resources when a maliciously crafted username is used when provisioning a new user...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the improper validation in the ipynb files of the library, which allows an attacker to inject and execute malicious javascript...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists when stripping EXIF data from specific images, leading to high CPU usage and an application crash...

Code Injection

gitlab is vulnerable to Code Injection. The vulnerability exists due to improper access restrictions which allows an attacker to inject and execute arbitrary codes into the system...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists due to improper role base access restrictions which allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists due to improper restrictions in settings which allows an attacker to gain view access and perform unaothorized actions...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. An attacker with guest membership in a project can modify the severity of an incident...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the an attacker can see the basic information on private groups that a public project has been shared with...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. An attacker can cause an application crash by providing a maliciously crafted TIFF images...

HTML Injection

gitlab is vulnerable to HTML Injection. The vulnerability exists in the Swagger UI feature, which allows an attacker to inject and execute malicious HTML...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to an improper access control flaw which allows an atacker to gain access to private email address of issues and merge requests assignee to Webhook data consumers...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists in the SendEntry of the library, which allows an attacker to gain sensitive information through the URL of artifacts stored in object storage with a temporary availability via Rails logs...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An admin of a group can see the SCIM token of that group by visiting a specific endpoint...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability allows a project export leak the external webhook token value which allows a attacker to access to the projects...

Improper Session Management

gitlab is vulnerable to Improper Session Management. The vulnerability allows an attacker with physical access to a user’s machine may brute force the user’s password via the change password function by stealing the session id from the physical compromise of the account and splitting the attack...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. The vulnerability exists when an admin uses the impersonate feature twice and stops impersonating, the admin may be logged in as the second user they impersonated, which may lead to repudiation issues...

Server Side Request Forgery (SSRF)

gitlab is vulnerable to Server Side Request Forgery SSRF. The vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability allows an attacker with inherited access to a project from a parent group to still have access even after the subgroup is transferred...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project which may lead to information disclosure if the project is imported from ...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS. The vulnerability is due to allowing of parsing files without authorisation which allows an attacker to cause an application crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. A lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users...

Authentication Bypass

gitlab is vulnerable to Authentication Bypass. The vulnerability allows an attacker to bypass 2FA for LDAP users and access some specific pages with Basic Authentication...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the Flavored Markdown in the library, which allows an attacker to inject and execute malicious javascript...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper permissions rules allowing an attacker to read confidential Epic references...

Authorization Bypass

gitlab is vulnerable to Authorization Bypass. The vulnerability allows a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability an attacker to use a few endpoints to retrieve information about any GitLab user...

Cross-Site Scripting (XSS)

gitlab is vulnerable to stored Reflected Cross-Site Scripting XSS. The vulnerability allows an attacker to execute arbitrary javascript code...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to lack of view permissions of trigger tokens which allows an attacker to expose trigger tokens configured on that project...

Improper Authentication

gitlab is vulnerable to Improper Authentication. The vulnerability exists due to missing authentication which allows an attacker with access to a victim's session to disable two-factor authentication...