Gitlab

GitLab

1474 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2017-11437

  • EPSS 0.79%
  • Veröffentlicht 02.08.2017 19:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.

6.5

CVE-2017-11438

  • EPSS 0.62%
  • Veröffentlicht 02.08.2017 19:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.

6.1

CVE-2017-8778

Exploit
  • EPSS 0.88%
  • Veröffentlicht 04.05.2017 15:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.

8.2

CVE-2016-9469

Exploit
  • EPSS 2.4%
  • Veröffentlicht 28.03.2017 02:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could...

6.3

CVE-2017-0882

Exploit
  • EPSS 1.06%
  • Veröffentlicht 28.03.2017 02:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

8.8

CVE-2016-4340

Exploit
  • EPSS 10.14%
  • Veröffentlicht 23.01.2017 21:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.

6.5

CVE-2016-9086

  • EPSS 5.39%
  • Veröffentlicht 03.11.2016 10:59:09
  • Zuletzt bearbeitet 06.05.2026 22:30:45

GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files (tar). All GitLab ver...

6.5

CVE-2013-4489

  • EPSS 1.41%
  • Veröffentlicht 17.05.2014 20:55:02
  • Zuletzt bearbeitet 06.05.2026 22:30:45

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

6.5

CVE-2013-4546

  • EPSS 1.54%
  • Veröffentlicht 13.05.2014 15:55:04
  • Zuletzt bearbeitet 06.05.2026 22:30:45

The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.

4.3

CVE-2014-3456

  • EPSS 0.94%
  • Veröffentlicht 13.05.2014 15:55:04
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.