GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
6
On KEV
10.0
Max CVSS
37
New 30D
Severity mix
Critical 70High 357Medium 73Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9633 | 7.5 | Nov 14 | Incorrect Ownership Assignment in GitLab Affected: 16.3 before 17.4.2; 17.5 before 17.5.4; 17.6 before 17.6.2 |
| CVE-2024-4660 | 7.5 | Sep 12 | Missing Authorization in GitLab Affected: 11.2 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-8124 | 7.5 | Sep 12 | Inefficient Regular Expression Complexity in GitLab Affected: 16.4 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-2800 | 7.5 | Aug 8 | Uncontrolled Resource Consumption in GitLab Affected: 11.3 before 17.0.6; 17.1 before 17.1.4; 17.2 before 17.2.2 |
| CVE-2024-6329 | 7.5 | Aug 8 | Improper Encoding or Escaping of Output in GitLab Affected: 8.16 before 17.0.6; 17.1 before 17.1.4; 17.2 before 17.2.2 |
| CVE-2024-6323 | 7.5 | Jun 26 | Improper Isolation or Compartmentalization in GitLab Affected: 16.11.0 before 16.11.5; 17.0.0 before 17.0.3; 17.1.0 before 17.1.1 |
| CVE-2024-2829 | 7.5 | Apr 25 | Inefficient Regular Expression Complexity in GitLab Affected: 12.5 before 16.9.6; 16.10 before 16.10.4; 16.11 before 16.11.1 |
| CVE-2023-3904 | 7.5 | Dec 15 | Improper Validation of Specified Type of Input in GitLab Affected: through 16.4.3; 16.5 before 16.5.4; 16.6 before 16.6.2 |
| CVE-2023-5226 | 7.5 | Dec 1 | Improper Control of Generation of Code ('Code Injection') in GitLab Affected: before 16.4.3; 16.5 before 16.5.3; 16.6 before 16.6.1 |
| CVE-2023-5995 | 7.5 | Dec 1 | Incorrect Authorization in GitLab Affected: 16.2 before 16.4.3; 16.5 before 16.5.3; 16.6 before 16.6.1 |
| CVE-2023-4379 | 7.5 | Nov 9 | Incorrect Authorization in GitLab Affected: 15.3 before 16.2.8; 16.3 before 16.3.5; 16.4 before 16.4.1 |
| CVE-2023-5106 | 7.5 | Oct 2 | Incorrect Authorization in GitLab Affected: 13.12 before 16.2.8; 16.3.0 before 16.3.5; 16.4.0 before 16.4.1 |
| CVE-2023-3413 | 7.5 | Sep 29 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 16.2 before 16.2.8; 16.3 before 16.3.5; 16.4 before 16.4.1 |
| CVE-2023-3917 | 7.5 | Sep 29 | Improper Validation of Specified Type of Input in GitLab Affected: before 16.2.8; 16.3 before 16.3.5; 16.4 before 16.4.1 |
| CVE-2023-4647 | 7.5 | Sep 1 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 15.2 before 16.1.5; 16.2 before 16.2.5; 16.3 before 16.3.1 |
| CVE-2023-4011 | 7.5 | Aug 2 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 15.11 before 16.2.2 |
| CVE-2023-3900 | 7.5 | Aug 2 | Improper Validation of Specified Type of Input in GitLab Affected: 16.1 before 16.1.3; 16.2 before 16.2.2 |
| CVE-2023-3993 | 7.5 | Aug 2 | Insertion of Sensitive Information into Log File in GitLab Affected: 14.3 before 16.0.8; 16.1 before 16.1.3; 16.2 before 16.2.2 |
| CVE-2023-3994 | 7.5 | Aug 2 | Inefficient Regular Expression Complexity in GitLab Affected: 9.3 before 16.0.8; 16.1 before 16.1.3; 16.2 before 16.2.2 |
| CVE-2023-0632 | 7.5 | Aug 1 | Inefficient Regular Expression Complexity in GitLab Affected: 15.2 before 16.0.8; 16.1.0 before 16.1.3; 16.2.0 before 16.2.2 |
| CVE-2023-3364 | 7.5 | Aug 1 | Inefficient Regular Expression Complexity in GitLab Affected: 8.14 before 16.0.8; 16.1 before 16.1.3; 16.2 before 16.2.2 |
| CVE-2023-3424 | 7.5 | Jul 13 | Inefficient Regular Expression Complexity in GitLab Affected: 10.3 before 15.11.10; 16.0 before 16.0.6; 16.1 before 16.1.1 |
| CVE-2023-2199 | 7.5 | Jun 7 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… Affected: 12.0.0 before 15.10.8; 12.0.0 before 15.10.8; 15.11.0 before 15.11.7; 15.11.0 before 15.11.7; 16.0.0 before 16.0.2; 16.0.0 before 16.0.2 |
| CVE-2023-2198 | 7.5 | Jun 7 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… Affected: 8.7.0 before 15.10.8; 8.7.0 before 15.10.8; 15.11.0 before 15.11.7; 15.11.0 before 15.11.7; 16.0.0 before 16.0.2; 16.0.0 before 16.0.2 |
| CVE-2023-0121 | 7.5 | Jun 7 | A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions… Affected: 13.2.4 before 15.10.8; 13.2.4 before 15.10.8; 15.11.0 before 15.11.7; 15.11.0 before 15.11.7; 16.0.0 before 16.0.2; 16.0.0 before 16.0.2 |
| CVE-2023-2132 | 7.5 | Jun 6 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… Affected: 15.4.0 before 15.10.8; 15.4.0 before 15.10.8; 15.11.0 before 15.11.7; 15.11.0 before 15.11.7; 16.0.0 before 16.0.2; 16.0.0 before 16.0.2 |
| CVE-2023-2825 | 7.5 | May 26 | An issue has been discovered in GitLab CE/EE affecting only version 16.0.0 Affected: 16.0.0; 16.0.0 |
| CVE-2018-17455 | 7.5 | Apr 15 | An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2018-17449 | 7.5 | Apr 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2018-15472 | 7.5 | Apr 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2023-1733 | 7.5 | Apr 5 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1 Affected: 11.10.0 before 15.8.5; 11.10.0 before 15.8.5; 15.9.0 before 15.9.4; 15.9.0 before 15.9.4; 15.10.0; 15.10.0 |
| CVE-2023-0518 | 7.5 | Feb 13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from… Affected: 14.0 before 15.6.7; 14.0 before 15.6.7; 15.7 before 15.7.6; 15.7 before 15.7.6; 15.8 before 15.8.1; 15.8 before 15.8.1 |
| CVE-2022-3759 | 7.5 | Feb 13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from… Affected: 14.3 before 15.6.7; 14.3 before 15.6.7; 15.7 before 15.7.6; 15.7 before 15.7.6; 15.8 before 15.8.1; 15.8 before 15.8.1 |
| CVE-2022-4205 | 7.5 | Jan 27 | In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash Affected: 1.0.0 before 12.9.8; 1.0.0 before 12.9.8; 15.5.0 before 15.5.5; 15.5.0 before 15.5.5; 15.6.0; 15.6.0 |
| CVE-2022-4167 | 7.5 | Jan 12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue… Affected: 13.11.0 before 15.5.7; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2 |
| CVE-2022-3613 | 7.5 | Jan 12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2 Affected: before 15.5.7; before 15.5.7; 15.6.0 before 15.6.4; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2; 15.7.0 before 15.7.2 |
| CVE-2022-3285 | 7.5 | Nov 9 | Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to… Affected: 12.0.0 before 15.2.5; 12.0.0 before 15.2.5; 15.3.0 before 15.3.4; 15.3.0 before 15.3.4; 15.4.0; 15.4.0 |
| CVE-2022-3639 | 7.5 | Oct 21 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting… Affected: >=10.8, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2022-3031 | 7.5 | Oct 17 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 Affected: >=15.3, <15.3.2; >=15.2, <15.2.4; >=0.0, <15.1.6 |
| CVE-2022-2931 | 7.5 | Oct 17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3… Affected: <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2022-3283 | 7.5 | Oct 17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from… Affected: >=15.4, <15.4.1; >=15.3, <15.3.4; <15.2.5 |
| CVE-2022-2501 | 7.5 | Aug 5 | An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP… Affected: >=12.0, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-2498 | 7.5 | Aug 5 | An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the… Affected: >=12.8, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-2229 | 7.5 | Jul 1 | An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the… Affected: 13.7.0 before 14.10.5; 13.7.0 before 14.10.5; 15.0.0 before 15.0.4; 15.0.0 before 15.0.4; 15.1.0; 15.1.0 |
| CVE-2022-1413 | 7.5 | May 19 | Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before… Affected: 1.0.2 before 14.8.6; 1.0.2 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-1510 | 7.5 | May 11 | An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10… Affected: 13.9.0 before 14.8.6; 13.9.0 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-1174 | 7.5 | Apr 4 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before… Affected: 13.7.0 before 14.7.7; 13.7.0 before 14.7.7; 14.8.0 before 14.8.5; 14.8.0 before 14.8.5; 14.9.0 before 14.9.2; 14.9.0 before 14.9.2 |
| CVE-2022-0741 | 7.5 | Apr 1 | Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses Affected: 10.0.0 before 14.6.5; 10.0.0 before 14.6.5; 14.7.0 before 14.7.4; 14.7.0 before 14.7.4; 14.8.0 before 14.8.2; 14.8.0 before 14.8.2 |
| CVE-2021-39908 | 7.5 | Apr 1 | In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode… Affected: 0.8.0 before 14.2.6; 0.8.0 before 14.2.6; 14.3.0 before 14.3.4; 14.3.0 before 14.3.4; 14.4.0; 14.4.0 |
| CVE-2022-0738 | 7.5 | Mar 28 | An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8… Affected: 10.0 before 14.6.5; 10.0 before 14.6.5; 14.7 before 14.7.4; 14.7 before 14.7.4; 14.8 before 14.8.2; 14.8 before 14.8.2 |
The 500 most important CVEs for this product (exploited first, then by severity)