Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control – 2021-10-18 $600 21 Race condition in GitLab import, giving access to other people their imports due to filename collision #214028 Valid Information Disclosure – 2017-10-03 – 22 CRLF injection & SSRF in git:// protocal lead to arbitrary code execution #441090 Valid Server-Side Request Forgery – 2020-11-23 – 22 Attacker can create malicious child epics linked to a victim's epic in an unrelated group #1892200 Valid Insecure Direct Object Reference – 2023-06-02 $1,160 22 Possibilty to purchase Ultimate - 1 Year (EDU or OSS) #882848 Valid Input Validation and Logic – 2020-11-02 – 23 ReDoS due to device-detector parsing user agents #1772063 Valid Denial of Service Medium 2024-10-08 – 23 Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure – 2018-12-03 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure – 2019-09-01 – 24 Persistent XSS via e-mail when creating merge requests #496973 Valid Cross-site Scripting – 2019-08-30 – 24 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure – 2020-11-21 – 24 SafeParamsHelper::safe_params is not so safe #946728 Valid Cross-site Scripting – 2020-11-02 $4,000 24 Stealing data from customers.gitlab.com without user interaction #674195 Valid Insecure Direct Object Reference – 2020-08-26 – 25 Domain Takeover - gl-canary.freetls.fastly.net #716677 Valid Access Control – 2023-05-30 $200 25 Stored XSS on PyPi simple API endpoint #856836 Valid Cross-site Scripting – 2020-09-09 $3,000 25 DOS via issue preview #1543718 Valid Denial of Service – 2022-11-04 $7,640 25 Claiming package names in GitLab's automatic package referencer. #462503 Valid Input Validation and Logic – 2019-04-05 $1,000 26 A profile page of a user can be denied from loading by appending .html to the username #475098 Valid Misconfiguration and Insecure Design – 2021-08-30 $200 26 No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im #702987 Valid Denial of Service – 2020-05-15 – 26 Bypassing password authentication of users that have 2FA enabled #128085 Valid Authentication – 2016-04-18 – 27 Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) #439729 Valid Insecure Direct Object Reference – 2019-09-19 – 27 Stored XSS in group issue list #859333 Valid Cross-site Scripting – 2020-11-21 $2,000 27 Stored DOM XSS via Mermaid chart #1103258 Valid Cross-site Scripting – 2021-07-12 $3,000 27 Drive-by arbitrary file deletion in the GDK via letter_opener_web gem #1353103 Valid Cross-Site Request Forgery – 2021-11-12 $750 27 Access Projects And create projects in gitlab pre production server #540711 Valid Access Control – 2019-08-28 – 28 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure – 2021-01-08 – 29 Stored XSS in repository file viewer #1072868 Valid Cross-site Scripting – 2022-05-19 $2,000 29 Guest Users can create issues for Sentry errors and track their status #1117768 Valid Access Control – 2021-09-24 $610 29 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet #1751258 Valid Insecure Direct Object Reference – 2023-06-02 $1,730 29 GitLab's GitHub integration is vulnerable to SSRF vulnerability #446593 Valid Server-Side Request Forgery – 2019-08-30 $2,000 30 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com #174983 Valid Access Control – 2016-12-06 – 31 Uncontrolled Resource Consumption in any Markdown field using Mermaid #670572 Valid Denial of Service – 2019-12-20 – 31 Remote hacker can download all the files of master branch in public projects where everything is members only. #1043480 Valid Authentication – 2021-02-15 – 31 Vulnerability in project import leads to arbitrary command execution #378148 Valid Command and Code Injection – 2018-08-22 – 32 Privilege escalation due to insecure use of logrotate #578119 Valid Access Control – 2019-10-01 – 32 Stored XSS in merge request creation page through payload in approval rule name #1342009 Valid Cross-site Scripting – 2022-03-31 – 32 Maintainer can leak sentry token by changing the configured URL (fix bypass) #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 Insecure 2FA/authentication implementation creates a brute force vulnerability #149598 Valid Misconfiguration and Insecure Design – 2016-10-28 – 33 Stored-XSS in merge requests #977697 Valid Cross-site Scripting – 2021-07-13 – 33 Store-XSS in error message of build-dependencies #950190 Valid Cross-site Scripting – 2020-12-01 – 35 Clipboard DOM-based XSS #1196958 Valid Cross-site Scripting – 2021-08-19 – 35 IDOR in "external status check" API leaks data about any status check on the instance #1372216 Valid Insecure Direct Object Reference – 2022-02-22 – 35 Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook #299473 Valid Server-Side Request Forgery – 2018-04-27 $750 36 Bypassing push rules via MRs created by Email #526570 Valid Access Control – 2019-10-01 – 36 Injection of `http.<url>.*` git config settings leading to SSRF #855276 Valid Server-Side Request Forgery – 2020-09-08 $3,000 36 Exposure of a valid Gitlab-Workhorse JWT leading to various bad things #1040786 Valid Authentication – 2022-07-05 $10,000 36 Stored XSS in blob viewer #806571 Valid Cross-site Scripting – 2020-08-04 – 37 Stored XSS on issue comments and other pages which contain notes #1398305 Valid Cross-site Scripting – 2022-06-08 $3,000 38 Removed Guest role user who dosent have access to private project in members able to view jobs #2668302 Informative Access Control None 2024-09-18 – 38 Using GitLab to monitor and hijack domains in mass quantity. #312118 Valid Input Validation and Logic – 2018-02-21 $750 39 When you call your branch the same name as a git hash, it could be checked out by dependents #790634 Valid Injection and Smuggling – 2021-08-19 $2,000 39