Unauthorized users may be able to view almost all informations related to Private projects. #407763 Valid Information Disclosure – 2018-12-03 – 24 ReDoS due to device-detector parsing user agents #1772063 Valid Denial of Service Medium 2024-10-08 – 23 Possibilty to purchase Ultimate - 1 Year (EDU or OSS) #882848 Valid Input Validation and Logic – 2020-11-02 – 23 Attacker can create malicious child epics linked to a victim's epic in an unrelated group #1892200 Valid Insecure Direct Object Reference – 2023-06-02 $1,160 22 CRLF injection & SSRF in git:// protocal lead to arbitrary code execution #441090 Valid Server-Side Request Forgery – 2020-11-23 – 22 Race condition in GitLab import, giving access to other people their imports due to filename collision #214028 Valid Information Disclosure – 2017-10-03 – 22 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control – 2021-10-18 $600 21 Stored XSS for Grafana dashboard URL #684268 Valid Cross-site Scripting – 2022-07-13 – 21 Gitlab is vulnerable to impersonation attacks due to broken links #265696 Valid Misconfiguration and Insecure Design – 2017-09-06 – 21 Instant open redirect on Live preview WEB Ide opening #437142 Valid Open Redirect – 2020-11-04 $1,000 20 [Markdown] Stored XSS via character encoding parser bypass #270999 Valid Cross-site Scripting – 2017-10-18 – 20 all private tokens are leaked to an unauthenticated attacker #268794 Valid Access Control – 2017-09-21 – 20 CSV injection in gitlab.com via issues export feature. #216243 Valid Command and Code Injection – 2017-07-21 – 20 SSRF vulnerability in gitlab.com via project import. #215105 Valid Server-Side Request Forgery – 2017-11-09 – 20 DOS via move_issue #1543584 Valid Denial of Service – 2022-11-04 $2,300 19 HTML TAG INJECTION ON PROFILE NAME #358001 Valid Cross-site Scripting – 2018-07-27 – 19 Unauthorized access #1669176 Informative Access Control – 2022-08-25 – 18 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control – 2020-11-02 $4,000 18 Stored XSS in merge request pages #409380 Valid Cross-site Scripting – 2018-12-03 – 18 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control – 2022-09-22 – 17 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure – 2019-12-13 – 17 Stored XSS on Files overview by abusing git submodule URL #218872 Valid Cross-site Scripting – 2017-05-09 – 17 Privilege escalation to access all private groups and repositories #131210 Valid Access Control – 2016-07-27 – 17 Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... #960244 Valid Memory Corruption – 2020-11-02 $5,000 16 Stored XSS on Issue details page #384255 Valid Cross-site Scripting – 2018-10-30 – 16 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection – 2022-02-10 – 15 Gitlab Pages token theft using service workers #1439552 Valid Access Control – 2022-06-08 $1,680 14 Blind SSRF in FogBugz project import #709951 Duplicate Server-Side Request Forgery – 2023-05-30 – 14 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery – 2020-08-17 – 14 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure – 2021-03-09 – 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control – 2019-04-05 – 14 GitHub import allows user to create child group under existing namespace #301137 Valid Access Control – 2018-05-24 $750 14 Persistent XSS on public wiki pages #136333 Valid Cross-site Scripting – 2016-07-27 – 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control – 2022-06-08 – 13 ReDoS in syntax highlighting due to Rouge #1283484 Valid Denial of Service – 2021-11-15 $600 13 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control – 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control – 2020-10-06 – 13 Inadequate cache control in gitter allows to view private chat room #493791 Duplicate Authentication – 2019-03-08 – 13 User with guest access can access private merge requests #195134 Valid Access Control – 2017-01-23 – 13 Container escape on public GitLab CI runners #1442118 Informative Access Control – 2022-04-27 – 12 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting – 2022-06-08 $1,130 12 GraphQL Query leads to sensitive information disclosure #985124 Duplicate Information Disclosure – 2021-03-08 – 12 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery – 2020-09-08 – 12 Impersonation attack via Broken Link in Resellers Page #266908 Valid Misconfiguration and Insecure Design – 2017-09-08 – 12 Every user can delete public deploy keys #195088 Valid Access Control – 2017-01-23 – 12 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control – 2019-12-13 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control – 2019-12-13 $1,500 11 Persistent XSS - Selecting users as allowed merge request approvers #346217 Valid Cross-site Scripting – 2018-07-16 – 11 Unfiltered `class` attribute in markdown code #216453 Valid Cross-site Scripting – 2017-04-13 – 11