Vulnerabilities > Gitlab

DATE CVE VULNERABILITY TITLE RISK
2022-07-01 CVE-2022-0167 Cross-site Scripting vulnerability in Gitlab
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2.
network
gitlab CWE-79
4.3
2022-07-01 CVE-2022-1954 Unspecified vulnerability in Gitlab
A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers
network
low complexity
gitlab
5.0
2022-07-01 CVE-2022-1963 Unspecified vulnerability in Gitlab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1.
network
low complexity
gitlab
5.0
2022-07-01 CVE-2022-1981 Incorrect Authorization vulnerability in Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1.
network
gitlab CWE-863
3.5
2022-07-01 CVE-2022-1999 Unspecified vulnerability in Gitlab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1.
network
gitlab
4.3
2022-07-01 CVE-2022-2228 Unspecified vulnerability in Gitlab
Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range
network
low complexity
gitlab
4.0
2022-07-01 CVE-2022-2229 Incorrect Authorization vulnerability in Gitlab
An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they're a member of.
network
low complexity
gitlab CWE-863
5.0
2022-07-01 CVE-2022-2270 Incorrect Default Permissions vulnerability in Gitlab
An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1.
network
low complexity
gitlab CWE-276
5.0
2022-07-01 CVE-2022-1983 Exposure of Resource to Wrong Sphere vulnerability in Gitlab
Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.
network
low complexity
gitlab CWE-668
4.0
2022-07-01 CVE-2022-2185 Incorrect Permission Assignment for Critical Resource vulnerability in Gitlab
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.
network
low complexity
gitlab CWE-732
7.5