A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited repository size by modifying values in a project export.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed by an attacker making a crafted API call.
CVSS Score
4.3
EPSS Score
0.001
Published
2021-10-04
In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visiting a malicious website by spoofing the content in an error response.
CVSS Score
4.3
EPSS Score
0.003
Published
2021-10-04
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
CVSS Score
5.0
EPSS Score
0.002
Published
2021-08-25
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view
CVSS Score
2.7
EPSS Score
0.004
Published
2021-08-25
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
CVSS Score
4.3
EPSS Score
0.002
Published
2021-08-25
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status
CVSS Score
5.4
EPSS Score
0.002
Published
2021-08-25
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown
CVSS Score
8.7
EPSS Score
0.023
Published
2021-08-25
A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group
CVSS Score
4.3
EPSS Score
0.003
Published
2021-08-23