Skip to content
Fencer Intel

All · GitLab

Newest first, late arrivals on top. Also a feed.

  1. 7.3
    CVE-2021-22261 A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions s…
    GitLabbitnami
  2. 4.3
    CVE-2021-22258 The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
    GitLabbitnami
    EPSS 1.0% chance of exploitation in 30 days, percentile 63%
  3. 5.4
    CVE-2021-22262 Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all ver…
    GitLabbitnami
  4. 5.3
    CVE-2021-22257 An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1…
    GitLabbitnami
  5. 6.8
    CVE-2021-22264 An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1…
    GitLabbitnami
    EPSS 1.0% chance of exploitation in 30 days, percentile 63%
  6. 4.3
    CVE-2021-39889 In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the prote…
    GitLabbitnami
  7. 4.3
    CVE-2021-39870 In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by…
    GitLabbitnami
  8. 3.5
    CVE-2021-39881 In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitra…
    GitLabbitnami
  9. 2.6
    CVE-2021-39886 Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up…
    GitLabbitnami
  10. 5.9
    CVE-2021-39891 In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the…
    GitLabbitnami
    EPSS 1.0% chance of exploitation in 30 days, percentile 63%
  11. 5.4
    CVE-2021-39866 A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.
    GitLabbitnami
  12. 6.5
    CVE-2021-39872 In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still ac…
    GitLabbitnami
  13. 5.4
    CVE-2021-39894 In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers…
    GitLabbitnami
  14. 6.5
    CVE-2021-39869 In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.
    GitLabbitnami
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  15. 6.5
    CVE-2021-39867 In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trig…
    GitLabbitnami
  16. 5.3
    CVE-2021-39875 In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visi…
    GitLabbitnami
    EPSS 1.2% chance of exploitation in 30 days, percentile 67%
  17. 4.3
    CVE-2021-39884 In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privile…
    GitLabbitnami
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  18. 5.3
    CVE-2021-39882 In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.
    GitLabbitnami
  19. 4.3
    CVE-2021-39888 In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting fr…
    GitLabbitnami
    EPSS 1.2% chance of exploitation in 30 days, percentile 67%
  20. 5.3
    CVE-2021-39893 A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.
    GitLabbitnami
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  21. 5.8
    CVE-2021-39878 A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to ex…
    GitLabbitnami
  22. 7.3
    CVE-2021-39887 A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to ex…
    GitLabbitnami
  23. 4.3
    CVE-2021-39868 In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repo…
    GitLabbitnami
  24. 4.3
    CVE-2021-22259 A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.
    GitLabbitnami
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%
  25. 4.3
    CVE-2021-39874 In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.
    GitLabbitnami
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%
  26. 4.3
    CVE-2021-39883 Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5…
    GitLabbitnami
  27. 4.3
    CVE-2021-39871 In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed…
    GitLabbitnami
  28. 2.9
    CVE-2021-39899 In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change pa…
    GitLabbitnami
  29. 2.0
    CVE-2021-39900 Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with…
    GitLabbitnami
  30. 3.8
    CVE-2021-39896 In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may…
    GitLabbitnami