Total 1,419 security vulnerabilities recorded for gitlab software and firmware.
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling....
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service....
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions....
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control....
GitLab EE 10.1 through 12.7.2 allows Information Disclosure....
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure....
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2)....
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal....
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission...
The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitl...
The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Commun...
An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden withou...
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comment...
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in discl...
An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a block...
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names....
An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the...
A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the lib...
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed....