Attacker can extract list of private project's project members #128051 Valid Information Disclosure – 2016-08-01 – 10 ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year #1531958 Valid Denial of Service Medium 2022-09-13 – 9 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Revoked User can still view the Merge Request created by him via API #962604 Valid Access Control Medium 2021-03-15 $1,500 9 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure High 2020-11-30 – 9 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control Medium 2019-12-13 – 9 Users with guest access can post notes to private merge requests, issues, and snippets #195140 Valid Access Control Medium 2017-01-23 – 9 Markdown based stored XSS (IE only) #118024 Valid Cross-site Scripting – 2017-05-03 – 9 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure Low 2022-11-04 – 8 Elasticsearch leaks data through the notes scope #710006 Valid Access Control Medium 2020-10-06 – 8 XSS (Persistent) - Selecting role(s) for protected branches #346111 Valid Cross-site Scripting High 2018-07-16 – 8 Gitlab.com is vulnerable to reverse tabnabbing. (#2) #212629 Valid Misconfiguration and Insecure Design Medium 2017-05-09 – 8 Gitlab.com is vulnerable to reverse tabnabbing. #211065 Valid Open Redirect Low 2017-03-21 – 8 [RDoc] XSS in project README files #200693 Valid Cross-site Scripting Medium 2017-02-15 – 8 Persistent XSS on public project page #129736 Valid Cross-site Scripting – 2016-05-03 – 8 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure Medium 2020-11-02 – 7 Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7) #351554 Valid Cross-site Scripting Medium 2018-09-20 – 7 [reStructuredText] XSS in project README files #205497 Valid Cross-site Scripting Medium 2017-02-15 – 7 CSRF Token Bypass in Account Deletion #182487 Valid Cross-Site Request Forgery Low 2017-04-20 – 7 Private snippets in public / internal projects leaked though GitLab API #134305 Valid Information Disclosure – 2016-05-03 – 7 Labels created in private projects are leaked #132777 Valid Information Disclosure – 2016-05-03 – 7 CSRF-Token leak by request forgery #221432 Valid Cross-Site Request Forgery Medium 2017-10-09 – 6 Cookie bomb #221041 Valid Denial of Service Medium 2018-02-16 – 6 Attacker can post notes on private MR, snippets, and issues #134299 Valid Access Control – 2016-05-03 – 6 Attacker can delete (and read) private project webhooks #134292 Valid Access Control – 2016-05-03 – 6 GFM renderer leaks external issue tracker URL of private project #133717 Valid Information Disclosure – 2017-06-08 – 6 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control High 2020-09-08 – 5 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure Low 2019-12-13 – 5 Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3) #213114 Valid Misconfiguration and Insecure Design Medium 2017-05-09 – 5 [Textile] XSS in project README files #205498 Valid Cross-site Scripting Medium 2017-02-15 – 5 Confidential issues leaked in public projects when attached to milestone #134300 Valid Information Disclosure – 2016-05-03 – 5 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control Medium 2020-08-26 $3,000 4 [Repository Import] Open Redirect via "continue[to]" parameter #215970 Valid Open Redirect Medium 2017-04-06 – 4 Open redirect #214034 Valid Open Redirect Medium 2017-04-06 – 4