Possibilty to purchase Ultimate - 1 Year (EDU or OSS) #882848 Valid Input Validation and Logic Low 2020-11-02 – 23 Attacker can create malicious child epics linked to a victim's epic in an unrelated group #1892200 Valid Insecure Direct Object Reference Medium 2023-06-02 $1,160 22 CRLF injection & SSRF in git:// protocal lead to arbitrary code execution #441090 Valid Server-Side Request Forgery High 2020-11-23 – 22 Race condition in GitLab import, giving access to other people their imports due to filename collision #214028 Valid Information Disclosure Low 2017-10-03 – 22 Reporters can upload design to issues using the "Move to" feature #1112297 Valid Access Control Medium 2021-10-18 $600 21 Stored XSS for Grafana dashboard URL #684268 Valid Cross-site Scripting High 2022-07-13 – 21 Gitlab is vulnerable to impersonation attacks due to broken links #265696 Valid Misconfiguration and Insecure Design Low 2017-09-06 – 21 Instant open redirect on Live preview WEB Ide opening #437142 Valid Open Redirect Low 2020-11-04 $1,000 20 [Markdown] Stored XSS via character encoding parser bypass #270999 Valid Cross-site Scripting Medium 2017-10-18 – 20 all private tokens are leaked to an unauthenticated attacker #268794 Valid Access Control Critical 2017-09-21 – 20 CSV injection in gitlab.com via issues export feature. #216243 Valid Command and Code Injection Medium 2017-07-21 – 20 SSRF vulnerability in gitlab.com via project import. #215105 Valid Server-Side Request Forgery Medium 2017-11-09 – 20 DOS via move_issue #1543584 Valid Denial of Service Medium 2022-11-04 $2,300 19 HTML TAG INJECTION ON PROFILE NAME #358001 Valid Cross-site Scripting Low 2018-07-27 – 19 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control High 2020-11-02 $4,000 18 Stored XSS in merge request pages #409380 Valid Cross-site Scripting High 2018-12-03 – 18 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control Medium 2022-09-22 – 17 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure Low 2019-12-13 – 17 Stored XSS on Files overview by abusing git submodule URL #218872 Valid Cross-site Scripting High 2017-05-09 – 17 Privilege escalation to access all private groups and repositories #131210 Valid Access Control – 2016-07-27 – 17 Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... #960244 Valid Memory Corruption High 2020-11-02 $5,000 16 Stored XSS on Issue details page #384255 Valid Cross-site Scripting High 2018-10-30 – 16 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection Medium 2022-02-10 – 15 Gitlab Pages token theft using service workers #1439552 Valid Access Control Medium 2022-06-08 $1,680 14 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery Medium 2020-08-17 – 14 [information disclosure] Validate existence of a private project. #605608 Valid Information Disclosure Low 2021-03-09 – 14 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control Medium 2019-04-05 – 14 GitHub import allows user to create child group under existing namespace #301137 Valid Access Control High 2018-05-24 $750 14 Persistent XSS on public wiki pages #136333 Valid Cross-site Scripting – 2016-07-27 – 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control Medium 2022-06-08 – 13 ReDoS in syntax highlighting due to Rouge #1283484 Valid Denial of Service Medium 2021-11-15 $600 13 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control Low 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control Medium 2020-10-06 – 13 User with guest access can access private merge requests #195134 Valid Access Control Medium 2017-01-23 – 13 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting Medium 2022-06-08 $1,130 12 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery Medium 2020-09-08 – 12 Impersonation attack via Broken Link in Resellers Page #266908 Valid Misconfiguration and Insecure Design Low 2017-09-08 – 12 Every user can delete public deploy keys #195088 Valid Access Control Medium 2017-01-23 – 12 SSRF when importing a project from a git repo by URL #135937 Valid Information Disclosure – 2018-05-29 – 12 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control Low 2019-12-13 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control Medium 2019-12-13 $1,500 11 Persistent XSS - Selecting users as allowed merge request approvers #346217 Valid Cross-site Scripting Medium 2018-07-16 – 11 Unfiltered `class` attribute in markdown code #216453 Valid Cross-site Scripting Medium 2017-04-13 – 11 [Subgroups] Unprivileged User Can Disclose Private Group Names #215384 Valid Insecure Direct Object Reference Medium 2017-03-30 – 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control High 2016-12-06 – 11 XSS On meta tags in profile page #159984 Valid Cross-site Scripting – 2016-08-21 – 11 Last pipeline status for MR leaked #582349 Valid Authentication Low 2019-10-01 – 10 SSRF vulnerability in gitlab.com webhook #301924 Valid Server-Side Request Forgery Medium 2018-04-30 – 10 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure Medium 2017-01-23 – 10 Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10