Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure – 2017-01-23 – 10 SSRF vulnerability in gitlab.com webhook #301924 Valid Server-Side Request Forgery – 2018-04-30 – 10 Last pipeline status for MR leaked #582349 Valid Authentication – 2019-10-01 – 10 XSS On meta tags in profile page #159984 Valid Cross-site Scripting – 2016-08-21 – 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control – 2016-12-06 – 11 [Subgroups] Unprivileged User Can Disclose Private Group Names #215384 Valid Insecure Direct Object Reference – 2017-03-30 – 11 Unfiltered `class` attribute in markdown code #216453 Valid Cross-site Scripting – 2017-04-13 – 11 Persistent XSS - Selecting users as allowed merge request approvers #346217 Valid Cross-site Scripting – 2018-07-16 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control – 2019-12-13 $1,500 11 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control – 2019-12-13 – 11 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 Every user can delete public deploy keys #195088 Valid Access Control – 2017-01-23 – 12 Impersonation attack via Broken Link in Resellers Page #266908 Valid Misconfiguration and Insecure Design – 2017-09-08 – 12 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery – 2020-09-08 – 12 GraphQL Query leads to sensitive information disclosure #985124 Duplicate Information Disclosure – 2021-03-08 – 12 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting – 2022-06-08 $1,130 12 Container escape on public GitLab CI runners #1442118 Informative Access Control – 2022-04-27 – 12 User with guest access can access private merge requests #195134 Valid Access Control – 2017-01-23 – 13 Inadequate cache control in gitter allows to view private chat room #493791 Duplicate Authentication – 2019-03-08 – 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control – 2020-10-06 – 13 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control – 2020-11-09 $100 13 ReDoS in syntax highlighting due to Rouge #1283484 Valid Denial of Service – 2021-11-15 $600 13 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control – 2022-06-08 – 13 Persistent XSS on public wiki pages #136333 Valid Cross-site Scripting – 2016-07-27 – 14 GitHub import allows user to create child group under existing namespace #301137 Valid Access Control – 2018-05-24 $750 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control – 2019-04-05 – 14 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure – 2021-03-09 – 14 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery – 2020-08-17 – 14 Blind SSRF in FogBugz project import #709951 Duplicate Server-Side Request Forgery – 2023-05-30 – 14 Gitlab Pages token theft using service workers #1439552 Valid Access Control – 2022-06-08 $1,680 14 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection – 2022-02-10 – 15 Stored XSS on Issue details page #384255 Valid Cross-site Scripting – 2018-10-30 – 16 Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... #960244 Valid Memory Corruption – 2020-11-02 $5,000 16 Privilege escalation to access all private groups and repositories #131210 Valid Access Control – 2016-07-27 – 17 Stored XSS on Files overview by abusing git submodule URL #218872 Valid Cross-site Scripting – 2017-05-09 – 17 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure – 2019-12-13 – 17 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control – 2022-09-22 – 17 Stored XSS in merge request pages #409380 Valid Cross-site Scripting – 2018-12-03 – 18 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control – 2020-11-02 $4,000 18 Unauthorized access #1669176 Informative Access Control – 2022-08-25 – 18 HTML TAG INJECTION ON PROFILE NAME #358001 Valid Cross-site Scripting – 2018-07-27 – 19 DOS via move_issue #1543584 Valid Denial of Service – 2022-11-04 $2,300 19 SSRF vulnerability in gitlab.com via project import. #215105 Valid Server-Side Request Forgery – 2017-11-09 – 20 CSV injection in gitlab.com via issues export feature. #216243 Valid Command and Code Injection – 2017-07-21 – 20 all private tokens are leaked to an unauthenticated attacker #268794 Valid Access Control – 2017-09-21 – 20 [Markdown] Stored XSS via character encoding parser bypass #270999 Valid Cross-site Scripting – 2017-10-18 – 20 Instant open redirect on Live preview WEB Ide opening #437142 Valid Open Redirect – 2020-11-04 $1,000 20 Gitlab is vulnerable to impersonation attacks due to broken links #265696 Valid Misconfiguration and Insecure Design – 2017-09-06 – 21 Stored XSS for Grafana dashboard URL #684268 Valid Cross-site Scripting – 2022-07-13 – 21