Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities #874401 Informative Information Disclosure – 2021-11-15 – 2 Stored-XSS in merge requests #1261148 Informative Cross-site Scripting None 2021-07-19 – 6 Responsible Disclosure of Privacy Leakage Issue #1089914 Informative Information Disclosure – 2021-06-29 – 7 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control – 2021-03-15 $1,500 9 GraphQL Query leads to sensitive information disclosure #985124 Duplicate Information Disclosure – 2021-03-08 – 12 ReDoS in syntax highlighting due to Rouge #1283484 Valid Denial of Service Medium 2021-11-15 $600 13 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure – 2021-03-09 – 14 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control – 2021-10-18 $600 21 A profile page of a user can be denied from loading by appending .html to the username #475098 Valid Misconfiguration and Insecure Design – 2021-08-30 $200 26 Stored DOM XSS via Mermaid chart #1103258 Valid Cross-site Scripting – 2021-07-12 $3,000 27 Drive-by arbitrary file deletion in the GDK via letter_opener_web gem #1353103 Valid Cross-Site Request Forgery Medium 2021-11-12 $750 27 Able to leak private email of any user given his/her username via graphql #972355 Valid Information Disclosure – 2021-01-08 – 29 Guest Users can create issues for Sentry errors and track their status #1117768 Valid Access Control – 2021-09-24 $610 29 Remote hacker can download all the files of master branch in public projects where everything is members only. #1043480 Valid Authentication – 2021-02-15 – 31 Stored-XSS in merge requests #977697 Valid Cross-site Scripting – 2021-07-13 – 33 Clipboard DOM-based XSS #1196958 Valid Cross-site Scripting Medium 2021-08-19 – 35 When you call your branch the same name as a git hash, it could be checked out by dependents #790634 Valid Injection and Smuggling – 2021-08-19 $2,000 39 Kroki Arbitrary File Read/Write #1098793 Valid Access Control – 2021-05-21 $5,600 41 Stored XSS in Mermaid when viewing Markdown files #1212822 Valid Cross-site Scripting High 2021-10-18 – 42 A deactivated user can access data through GraphQL #1192460 Valid Access Control Medium 2021-08-30 – 47 Stored XSS via Mermaid Prototype Pollution vulnerability #1280002 Valid Cross-site Scripting High 2021-11-18 $3,000 48 View the Starred Projects in a Private Profile #703894 Valid Insecure Direct Object Reference – 2021-02-02 $500 49 Guest users can create new test cases #1113289 Valid Access Control – 2021-08-30 $650 49 Stored XSS on the job page #856554 Valid Cross-site Scripting – 2021-01-08 $3,000 50 Change project visibility to a restricted option #1086781 Valid Misconfiguration and Insecure Design – 2021-12-30 $1,370 51 FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com #1092230 Valid Server-Side Request Forgery – 2021-07-13 – 58 Stored XSS via Mermaid Prototype Pollution vulnerability #1106238 Valid Cross-site Scripting – 2021-07-12 $3,000 58 Stored-XSS on wiki pages #1087061 Valid Cross-site Scripting – 2021-07-13 – 59 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token #1193062 Valid Access Control Medium 2021-10-11 – 66 Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name" #1256777 Valid Cross-site Scripting High 2021-09-15 – 80 Cache poisoning Denial of Service affecting assets.gitlab-static.net #1160407 Valid Denial of Service – 2021-12-22 – 83 CSRF on /api/graphql allows executing mutations through GET requests #1122408 Valid Cross-Site Request Forgery – 2021-08-02 $3,370 88 XSS in request approvals #402658 Valid Cross-site Scripting – 2021-04-23 $3,000 96 Stored XSS in custom emoji Analysed #1198517 Valid Cross-site Scripting High 2021-07-19 $3,000 130 Arbitrary file read during project import Analysed #1132378 Valid File and Path Handling – 2021-05-24 $16,000 194 Ability To Delete User(s) Account Without User Interaction Analysed #928255 Valid Misconfiguration and Insecure Design – 2021-03-17 – 221 Stored XSS in markdown via the DesignReferenceFilter Analysed #1212067 Valid Cross-site Scripting Critical 2021-10-18 $16,000 317 RCE via unsafe inline Kramdown options when rendering certain Wiki pages Analysed #1125425 Valid Command and Code Injection – 2021-04-20 $20,000 427 RCE when removing metadata with ExifTool Analysed #1154542 Valid Command and Code Injection – 2021-05-14 $20,000 508