XSS: `v-safe-html` is not safe enough Analysed #1579645 Valid Cross-site Scripting High 2022-11-16 – 43 Milestones leaked via search API Analysed #460815 Valid Access Control Low 2019-07-19 – 43 GitLab CI runner can read and poison cache of all other projects Analysed #301432 Valid File and Path Handling Critical 2018-04-27 $2,000 43 Stored XSS in Mermaid when viewing Markdown files Analysed #1212822 Valid Cross-site Scripting High 2021-10-18 – 42 Kroki Arbitrary File Read/Write Analysed #1098793 Valid Access Control High 2021-05-21 $5,600 41 SQL injection in MilestoneFinder order method Analysed #298176 Valid SQL Injection Critical 2018-04-27 $2,000 41 When you call your branch the same name as a git hash, it could be checked out by dependents Analysed #790634 Valid Injection and Smuggling Medium 2021-08-19 $2,000 39 Using GitLab to monitor and hijack domains in mass quantity. Analysed #312118 Valid Input Validation and Logic High 2018-02-21 $750 39 Stored XSS on issue comments and other pages which contain notes Analysed #1398305 Valid Cross-site Scripting High 2022-06-08 $3,000 38 Stored XSS in blob viewer Analysed #806571 Valid Cross-site Scripting Medium 2020-08-04 – 37 Exposure of a valid Gitlab-Workhorse JWT leading to various bad things Analysed #1040786 Valid Authentication High 2022-07-05 $10,000 36 Injection of `http.<url>.*` git config settings leading to SSRF Analysed #855276 Valid Server-Side Request Forgery High 2020-09-08 $3,000 36 Bypassing push rules via MRs created by Email Analysed #526570 Valid Access Control Medium 2019-10-01 – 36 Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook Analysed #299473 Valid Server-Side Request Forgery High 2018-04-27 $750 36 IDOR in "external status check" API leaks data about any status check on the instance Analysed #1372216 Valid Insecure Direct Object Reference Medium 2022-02-22 – 35 Clipboard DOM-based XSS Analysed #1196958 Valid Cross-site Scripting Medium 2021-08-19 – 35 Store-XSS in error message of build-dependencies Analysed #950190 Valid Cross-site Scripting High 2020-12-01 – 35 Stored-XSS in merge requests Analysed #977697 Valid Cross-site Scripting High 2021-07-13 – 33 Insecure 2FA/authentication implementation creates a brute force vulnerability Analysed #149598 Valid Misconfiguration and Insecure Design – 2016-10-28 – 33 Maintainer can leak sentry token by changing the configured URL (fix bypass) Analysed #2104591 Valid Information Disclosure Medium 2024-10-08 – 32 Stored XSS in merge request creation page through payload in approval rule name Analysed #1342009 Valid Cross-site Scripting High 2022-03-31 – 32 Privilege escalation due to insecure use of logrotate Analysed #578119 Valid Access Control Low 2019-10-01 – 32 Vulnerability in project import leads to arbitrary command execution Analysed #378148 Valid Command and Code Injection Critical 2018-08-22 – 32 Remote hacker can download all the files of master branch in public projects where everything is members only. Analysed #1043480 Valid Authentication Medium 2021-02-15 – 31 Uncontrolled Resource Consumption in any Markdown field using Mermaid Analysed #670572 Valid Denial of Service Medium 2019-12-20 – 31 Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com Analysed #174983 Valid Access Control – 2016-12-06 – 31 GitLab's GitHub integration is vulnerable to SSRF vulnerability Analysed #446593 Valid Server-Side Request Forgery Medium 2019-08-30 $2,000 30 Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet Analysed #1751258 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,730 29 Guest Users can create issues for Sentry errors and track their status Analysed #1117768 Valid Access Control Low 2021-09-24 $610 29 Stored XSS in repository file viewer Analysed #1072868 Valid Cross-site Scripting Medium 2022-05-19 $2,000 29 Able to leak private email of any user given his/her username via graphql Analysed #972355 Valid Information Disclosure Medium 2021-01-08 – 29 Access Projects And create projects in gitlab pre production server Analysed #540711 Valid Access Control Low 2019-08-28 – 28 Drive-by arbitrary file deletion in the GDK via letter_opener_web gem #1353103 Valid Cross-Site Request Forgery Medium 2021-11-12 $750 27 Stored DOM XSS via Mermaid chart #1103258 Valid Cross-site Scripting High 2021-07-12 $3,000 27 Stored XSS in group issue list #859333 Valid Cross-site Scripting Medium 2020-11-21 $2,000 27 Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) #439729 Valid Insecure Direct Object Reference Low 2019-09-19 – 27 Bypassing password authentication of users that have 2FA enabled #128085 Valid Authentication – 2016-04-18 – 27 No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im #702987 Valid Denial of Service Low 2020-05-15 – 26 A profile page of a user can be denied from loading by appending .html to the username #475098 Valid Misconfiguration and Insecure Design Low 2021-08-30 $200 26 Claiming package names in GitLab's automatic package referencer. #462503 Valid Input Validation and Logic Low 2019-04-05 $1,000 26 DOS via issue preview #1543718 Valid Denial of Service High 2022-11-04 $7,640 25 Stored XSS on PyPi simple API endpoint #856836 Valid Cross-site Scripting Medium 2020-09-09 $3,000 25 Domain Takeover - gl-canary.freetls.fastly.net #716677 Valid Access Control Low 2023-05-30 $200 25 Stealing data from customers.gitlab.com without user interaction #674195 Valid Insecure Direct Object Reference High 2020-08-26 – 25 SafeParamsHelper::safe_params is not so safe #946728 Valid Cross-site Scripting High 2020-11-02 $4,000 24 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure Medium 2020-11-21 – 24 Persistent XSS via e-mail when creating merge requests #496973 Valid Cross-site Scripting Low 2019-08-30 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure Low 2019-09-01 – 24 Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure Medium 2018-12-03 – 24 ReDoS due to device-detector parsing user agents #1772063 Valid Denial of Service Medium 2024-10-08 – 23