Vulnerabilities > Gitlab

DATE CVE VULNERABILITY TITLE RISK
2021-10-11 CVE-2021-22263 Improper Privilege Management vulnerability in Gitlab
An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2.
network
low complexity
gitlab CWE-269
5.5
2021-10-05 CVE-2021-39880 Unspecified vulnerability in Gitlab
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
network
low complexity
gitlab
4.0
2021-10-05 CVE-2021-22257 Unspecified vulnerability in Gitlab
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2.
network
low complexity
gitlab
5.0
2021-10-05 CVE-2021-22258 Unspecified vulnerability in Gitlab
The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses
network
low complexity
gitlab
4.0
2021-10-05 CVE-2021-22261 Cross-site Scripting vulnerability in Gitlab
A stored Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.7 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious Jira API responses
network
gitlab CWE-79
3.5
2021-10-05 CVE-2021-22262 Incorrect Authorization vulnerability in Gitlab
Missing access control in GitLab version 13.10 and above with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page
network
low complexity
gitlab CWE-863
5.0
2021-10-05 CVE-2021-22264 Unspecified vulnerability in Gitlab
An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2.
network
gitlab
4.3
2021-10-05 CVE-2021-39870 Unspecified vulnerability in Gitlab
In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call.
network
low complexity
gitlab
4.0
2021-10-05 CVE-2021-39881 Unspecified vulnerability in Gitlab
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrary scope names which may allow the malicious user to trick unsuspecting users to authorize the malicious client application using the spoofed scope name and description.
network
gitlab
3.5
2021-10-05 CVE-2021-39886 Incorrect Default Permissions vulnerability in Gitlab
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.
network
low complexity
gitlab CWE-276
4.0