Open redirect #214034 Valid Open Redirect – 2017-04-06 – 4 [Repository Import] Open Redirect via "continue[to]" parameter #215970 Valid Open Redirect – 2017-04-06 – 4 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control – 2020-08-26 $3,000 4 Confidential issues leaked in public projects when attached to milestone #134300 Valid Information Disclosure – 2016-05-03 – 5 [Textile] XSS in project README files #205498 Valid Cross-site Scripting – 2017-02-15 – 5 Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3) #213114 Valid Misconfiguration and Insecure Design – 2017-05-09 – 5 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure – 2019-12-13 – 5 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control – 2020-09-08 – 5 GFM renderer leaks external issue tracker URL of private project #133717 Valid Information Disclosure – 2017-06-08 – 6 Attacker can delete (and read) private project webhooks #134292 Valid Access Control – 2016-05-03 – 6 Attacker can post notes on private MR, snippets, and issues #134299 Valid Access Control – 2016-05-03 – 6 Cookie bomb #221041 Valid Denial of Service – 2018-02-16 – 6 CSRF-Token leak by request forgery #221432 Valid Cross-Site Request Forgery – 2017-10-09 – 6 Labels created in private projects are leaked #132777 Valid Information Disclosure – 2016-05-03 – 7 Private snippets in public / internal projects leaked though GitLab API #134305 Valid Information Disclosure – 2016-05-03 – 7 CSRF Token Bypass in Account Deletion #182487 Valid Cross-Site Request Forgery – 2017-04-20 – 7 [reStructuredText] XSS in project README files #205497 Valid Cross-site Scripting – 2017-02-15 – 7 Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7) #351554 Valid Cross-site Scripting – 2018-09-20 – 7 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure – 2020-11-02 – 7 Persistent XSS on public project page #129736 Valid Cross-site Scripting – 2016-05-03 – 8 [RDoc] XSS in project README files #200693 Valid Cross-site Scripting – 2017-02-15 – 8 Gitlab.com is vulnerable to reverse tabnabbing. #211065 Valid Open Redirect – 2017-03-21 – 8 Gitlab.com is vulnerable to reverse tabnabbing. (#2) #212629 Valid Misconfiguration and Insecure Design – 2017-05-09 – 8 XSS (Persistent) - Selecting role(s) for protected branches #346111 Valid Cross-site Scripting – 2018-07-16 – 8 Elasticsearch leaks data through the notes scope #710006 Valid Access Control – 2020-10-06 – 8 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure – 2022-11-04 – 8 Markdown based stored XSS (IE only) #118024 Valid Cross-site Scripting – 2017-05-03 – 9 Users with guest access can post notes to private merge requests, issues, and snippets #195140 Valid Access Control – 2017-01-23 – 9 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control – 2019-12-13 – 9 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure – 2020-11-30 – 9 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control – 2021-03-15 $1,500 9 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year #1531958 Valid Denial of Service – 2022-09-13 – 9 Attacker can extract list of private project's project members #128051 Valid Information Disclosure – 2016-08-01 – 10 Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure – 2017-01-23 – 10 SSRF vulnerability in gitlab.com webhook #301924 Valid Server-Side Request Forgery – 2018-04-30 – 10 Last pipeline status for MR leaked #582349 Valid Authentication – 2019-10-01 – 10 XSS On meta tags in profile page #159984 Valid Cross-site Scripting – 2016-08-21 – 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control – 2016-12-06 – 11 [Subgroups] Unprivileged User Can Disclose Private Group Names #215384 Valid Insecure Direct Object Reference – 2017-03-30 – 11 Unfiltered `class` attribute in markdown code #216453 Valid Cross-site Scripting – 2017-04-13 – 11 Persistent XSS - Selecting users as allowed merge request approvers #346217 Valid Cross-site Scripting – 2018-07-16 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control – 2019-12-13 $1,500 11 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control – 2019-12-13 – 11 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 Every user can delete public deploy keys #195088 Valid Access Control – 2017-01-23 – 12 Impersonation attack via Broken Link in Resellers Page #266908 Valid Misconfiguration and Insecure Design – 2017-09-08 – 12 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery – 2020-09-08 – 12 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting – 2022-06-08 $1,130 12