[Subgroups] Unprivileged User Can Disclose Private Group Names #215384 Valid Insecure Direct Object Reference – 2017-03-30 – 11 State filter in IssuableFinder allows attacker to delete all issues and merge requests #186194 Valid Access Control – 2016-12-06 – 11 XSS On meta tags in profile page #159984 Valid Cross-site Scripting – 2016-08-21 – 11 Last pipeline status for MR leaked #582349 Valid Authentication – 2019-10-01 – 10 SSRF vulnerability in gitlab.com webhook #301924 Valid Server-Side Request Forgery – 2018-04-30 – 10 Users can download old project exports due to unclaimed namespace #195058 Valid Information Disclosure – 2017-01-23 – 10 Boards leak private label names and desciptions #162147 Valid Information Disclosure – 2016-09-02 – 10 Attacker can extract list of private project's project members #128051 Valid Information Disclosure – 2016-08-01 – 10 ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year #1531958 Valid Denial of Service – 2022-09-13 – 9 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control – 2021-03-15 $1,500 9 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure – 2020-11-30 – 9 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control – 2019-12-13 – 9 Users with guest access can post notes to private merge requests, issues, and snippets #195140 Valid Access Control – 2017-01-23 – 9 Markdown based stored XSS (IE only) #118024 Valid Cross-site Scripting – 2017-05-03 – 9 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure – 2022-11-04 – 8 Adding everyone to the repo due to the lack of rate limit #978768 N/A Insecure Direct Object Reference – 2020-09-14 – 8 Elasticsearch leaks data through the notes scope #710006 Valid Access Control – 2020-10-06 – 8 XSS (Persistent) - Selecting role(s) for protected branches #346111 Valid Cross-site Scripting – 2018-07-16 – 8 Gitlab.com is vulnerable to reverse tabnabbing. (#2) #212629 Valid Misconfiguration and Insecure Design – 2017-05-09 – 8 Gitlab.com is vulnerable to reverse tabnabbing. #211065 Valid Open Redirect – 2017-03-21 – 8 [RDoc] XSS in project README files #200693 Valid Cross-site Scripting – 2017-02-15 – 8 Persistent XSS on public project page #129736 Valid Cross-site Scripting – 2016-05-03 – 8 Bypass for Domain-level redirects (Unvalidated Redirects and Forwar) #1582160 Informative Open Redirect – 2022-06-22 – 7 Responsible Disclosure of Privacy Leakage Issue #1089914 Informative Information Disclosure – 2021-06-29 – 7 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure – 2020-11-02 – 7 Potensial SSRF via Git repository URL #359288 Duplicate Server-Side Request Forgery – 2018-07-16 – 7 Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7) #351554 Valid Cross-site Scripting – 2018-09-20 – 7 [reStructuredText] XSS in project README files #205497 Valid Cross-site Scripting – 2017-02-15 – 7 CSRF Token Bypass in Account Deletion #182487 Valid Cross-Site Request Forgery – 2017-04-20 – 7 Private snippets in public / internal projects leaked though GitLab API #134305 Valid Information Disclosure – 2016-05-03 – 7 Labels created in private projects are leaked #132777 Valid Information Disclosure – 2016-05-03 – 7 Dependecy Confusion via Lookup Request Forwarding to PyPi.org #1681275 Informative Misconfiguration and Insecure Design – 2022-11-21 – 6 Found Origin IP's lead to access to gitlab #1637577 Informative Access Control – 2022-08-02 – 6 Stored-XSS in merge requests #1261148 Informative Cross-site Scripting – 2021-07-19 – 6 Double linking cause XSS (but blokeced by CSP in gitlab.com) #729341 N/A Cross-site Scripting – 2020-01-20 – 6 CSRF-Token leak by request forgery #221432 Valid Cross-Site Request Forgery – 2017-10-09 – 6 Cookie bomb #221041 Valid Denial of Service – 2018-02-16 – 6 Attacker can post notes on private MR, snippets, and issues #134299 Valid Access Control – 2016-05-03 – 6 Attacker can delete (and read) private project webhooks #134292 Valid Access Control – 2016-05-03 – 6 GFM renderer leaks external issue tracker URL of private project #133717 Valid Information Disclosure – 2017-06-08 – 6 Arbitrary escape sequence injection in docker-machine from worker nodes #1916285 Informative Command and Code Injection – 2023-06-02 – 5 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control – 2020-09-08 – 5 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure – 2019-12-13 – 5 Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds #491319 N/A Information Disclosure – 2019-02-08 – 5 Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3) #213114 Valid Misconfiguration and Insecure Design – 2017-05-09 – 5 [Textile] XSS in project README files #205498 Valid Cross-site Scripting – 2017-02-15 – 5 Confidential issues leaked in public projects when attached to milestone #134300 Valid Information Disclosure – 2016-05-03 – 5 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control – 2020-08-26 $3,000 4 [Repository Import] Open Redirect via "continue[to]" parameter #215970 Valid Open Redirect – 2017-04-06 – 4