Git flag injection - local file overwrite to remote code execution Analysed #658013 Valid Command and Code Injection Critical 2019-12-19 $12,000 777 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control Critical 2019-03-05 $11,000 762 Stored XSS in Wiki pages Analysed #526325 Valid Cross-site Scripting High 2019-09-02 – 633 Local files could be overwritten in GitLab, leading to remote command execution Analysed #587854 Valid Command and Code Injection Critical 2019-07-17 $12,000 542 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control Critical 2019-11-27 $12,000 457 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure Critical 2019-04-20 $12,000 366 Bypass of GitLab CI runner slash fix in YAML validation Analysed #409395 Valid Input Validation and Logic Critical 2019-04-10 – 363 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control High 2019-07-03 – 351 Cross-site Scripting (XSS) - Stored in RDoc wiki pages Analysed #662287 Valid Misconfiguration and Insecure Design High 2019-12-16 $3,500 282 Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic Medium 2019-08-30 – 249 Git flag injection leading to file overwrite and potential remote code execution Analysed #653125 Valid Command and Code Injection Critical 2019-12-19 $3,500 169 Importing GitLab project archives can replace uploads of other users Analysed #534794 Valid Insecure Direct Object Reference High 2019-12-11 – 148 DoS on the Issue page by exploiting Mermaid. Analysed #470067 Valid Denial of Service Medium 2019-05-13 $3,000 145 Persistent XSS in Note objects Analysed #508184 Valid Cross-site Scripting High 2019-07-19 $4,500 139 Git flag injection - Search API with scope 'blobs' Analysed #682442 Valid Command and Code Injection High 2019-12-15 $7,000 130 Group search with Elastic search enable leaks unrelated data Analysed #708820 Valid Access Control High 2019-12-14 – 100 DoS attack via comment on Issue Analysed #557154 Valid Denial of Service Low 2019-11-21 $1,000 84 GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery Analysed #541169 Valid Server-Side Request Forgery High 2019-12-12 – 72 SSRF in CI after first run Analysed #369451 Valid Server-Side Request Forgery Medium 2019-04-12 – 72 Know whether private project name exists or not within a group using link comments Analysed #495497 Valid Information Disclosure Low 2019-10-07 – 58 Bypass Email Verification using Salesforce -- Reproducible in gitlab.com Analysed #617896 Valid Misconfiguration and Insecure Design High 2019-12-13 – 55 All functions that allow users to specify color code are vulnerable to ReDoS Analysed #511381 Valid Denial of Service Low 2019-08-21 $1,000 53 Clientside resource Exhausting by exploiting gitlab math rendering Analysed #549040 Valid Denial of Service Low 2019-10-01 – 50 Milestones leaked via search API Analysed #460815 Valid Access Control Low 2019-07-19 – 43 Privilege escalation due to insecure use of logrotate Analysed #578119 Valid Access Control Low 2019-10-01 – 32 Uncontrolled Resource Consumption in any Markdown field using Mermaid Analysed #670572 Valid Denial of Service Medium 2019-12-20 – 31