Git flag injection - local file overwrite to remote code execution Analysed #658013 Valid Command and Code Injection – 2019-12-19 $12,000 777 Exfiltrate and mutate repository and project data through injected templated service Analysed #446585 Valid Access Control – 2019-03-05 $11,000 762 Stored XSS in Wiki pages Analysed #526325 Valid Cross-site Scripting – 2019-09-02 – 633 Local files could be overwritten in GitLab, leading to remote command execution Analysed #587854 Valid Command and Code Injection – 2019-07-17 $12,000 542 Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests Analysed #689314 Valid Access Control – 2019-11-27 $12,000 457 JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions Analysed #509924 Valid Information Disclosure – 2019-04-20 $12,000 366 Bypass of GitLab CI runner slash fix in YAML validation Analysed #409395 Valid Input Validation and Logic – 2019-04-10 – 363 Attacker is able to access commit title and team member comments which are supposed to be private Analysed #502593 Valid Access Control – 2019-07-03 – 351 Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com Analysed #498964 Valid Access Control – 2019-04-19 – 306 Cross-site Scripting (XSS) - Stored in RDoc wiki pages Analysed #662287 Valid Misconfiguration and Insecure Design – 2019-12-16 $3,500 282 Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain Analysed #565883 Valid Input Validation and Logic – 2019-08-30 – 249 Unauthenticated blind SSRF in OAuth Jira authorization controller Analysed #398799 Valid Server-Side Request Forgery – 2019-03-14 $4,000 238 Group search leaks private MRs, code, commits Analysed #692252 Valid Access Control – 2019-12-14 – 212 Git flag injection leading to file overwrite and potential remote code execution Analysed #653125 Valid Command and Code Injection – 2019-12-19 $3,500 169 Snippet JS template allows attacker to read a user's private snippets #348443 Valid Information Disclosure – 2019-03-03 $300 165 Importing GitLab project archives can replace uploads of other users #534794 Valid Insecure Direct Object Reference – 2019-12-11 – 148 information disclosure of secret_key_base via encoding charcters #460545 Valid Information Disclosure – 2019-06-13 $3,500 146 DoS on the Issue page by exploiting Mermaid. #470067 Valid Denial of Service – 2019-05-13 $3,000 145 Persistent XSS in Note objects #508184 Valid Cross-site Scripting – 2019-07-19 $4,500 139 Git flag injection - Search API with scope 'blobs' #682442 Valid Command and Code Injection – 2019-12-15 $7,000 130 Group search with Elastic search enable leaks unrelated data #708820 Valid Access Control – 2019-12-14 – 100 DoS attack via comment on Issue #557154 Valid Denial of Service – 2019-11-21 $1,000 84 GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery #541169 Valid Server-Side Request Forgery – 2019-12-12 – 72 SSRF in CI after first run #369451 Valid Server-Side Request Forgery – 2019-04-12 – 72 GraphQL query "namespace" leaks data #614355 Valid Access Control – 2019-12-03 – 64 Know whether private project name exists or not within a group using link comments #495497 Valid Information Disclosure – 2019-10-07 – 58 Bypass Email Verification using Salesforce -- Reproducible in gitlab.com #617896 Valid Misconfiguration and Insecure Design – 2019-12-13 – 55 All functions that allow users to specify color code are vulnerable to ReDoS #511381 Valid Denial of Service – 2019-08-21 $1,000 53 Clientside resource Exhausting by exploiting gitlab math rendering #549040 Valid Denial of Service – 2019-10-01 – 50 Milestones leaked via search API #460815 Valid Access Control – 2019-07-19 – 43 Bypassing push rules via MRs created by Email #526570 Valid Access Control – 2019-10-01 – 36 Privilege escalation due to insecure use of logrotate #578119 Valid Access Control – 2019-10-01 – 32 Uncontrolled Resource Consumption in any Markdown field using Mermaid #670572 Valid Denial of Service – 2019-12-20 – 31 GitLab's GitHub integration is vulnerable to SSRF vulnerability #446593 Valid Server-Side Request Forgery – 2019-08-30 $2,000 30 Access Projects And create projects in gitlab pre production server #540711 Valid Access Control – 2019-08-28 – 28 Add and Access to Labels of any Private Projects/Groups of Gitlab(IDOR) #439729 Valid Insecure Direct Object Reference – 2019-09-19 – 27 Claiming package names in GitLab's automatic package referencer. #462503 Valid Input Validation and Logic – 2019-04-05 $1,000 26 Persistent XSS via e-mail when creating merge requests #496973 Valid Cross-site Scripting – 2019-08-30 – 24 Last build status and coverage leaked to unauthorized users #477222 Valid Information Disclosure – 2019-09-01 – 24 Private System Note Disclosure using GraphQL #633001 Valid Information Disclosure – 2019-12-13 – 17 Removing a user from a private group doesn't remove him from group's project, if his project's role was changed #310185 Valid Access Control – 2019-04-05 – 14 Inadequate cache control in gitter allows to view private chat room #493791 Duplicate Authentication – 2019-03-08 – 13 Head pipeline leaked to unauthorized users via blocking merge request feature #667408 Valid Access Control – 2019-12-13 – 11 Blocked user Git access through CI/CD token #497047 Valid Access Control – 2019-12-13 $1,500 11 Last pipeline status for MR leaked #582349 Valid Authentication – 2019-10-01 – 10 Container scanning and Dependency scanning report leaked to unauthorized users #676976 Valid Access Control – 2019-12-13 – 9 Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings #636560 Valid Information Disclosure – 2019-12-13 – 5 Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds #491319 N/A Information Disclosure – 2019-02-08 – 5