Arbitrary file read via the UploadsRewriter when moving and issue Analysed #827052 Valid File and Path Handling – 2020-04-27 $20,000 1,503 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure – 2020-06-08 $10,000 410 SSRF on project import via the remote_attachment_url on a Note Analysed #826361 Valid Server-Side Request Forgery – 2020-06-07 $10,000 359 Server Side Request Forgery mitigation bypass Analysed #632101 Valid Server-Side Request Forgery – 2020-04-18 – 350 An attacker can run pipeline jobs as arbitrary user Analysed #894569 Valid Input Validation and Logic – 2020-08-26 $12,000 307 Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties Analysed #922456 Valid Authentication – 2020-10-01 $3,000 257 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control – 2020-08-26 – 256 Full Read SSRF on Gitlab's Internal Grafana #878779 Valid Server-Side Request Forgery – 2020-08-07 – 229 Send arbitrary PUT requests when user clicks on a link #824689 Valid Command and Code Injection – 2020-07-27 – 135 Unrestricted file upload leads to Stored XSS #880099 Valid Cross-site Scripting – 2020-08-03 – 90 Stored XSS in "Create Groups" #647130 Valid Cross-site Scripting – 2020-08-26 $2,500 89 GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection #955016 Valid Command and Code Injection – 2020-11-04 – 77 [Admin Panel] CSRF to resume/pause runner #415238 Valid Cross-Site Request Forgery – 2020-12-01 – 60 EXIF metadata not stripped from JPG group logos #446238 Valid Information Disclosure – 2020-09-08 $500 55 Stored XSS in markdown when redacting references #836649 Valid Cross-site Scripting – 2020-09-09 $5,000 50 XSS on Issue reference numbers #831962 Valid Cross-site Scripting – 2020-11-23 – 49 Stored XSS in blob viewer #806571 Valid Cross-site Scripting – 2020-08-04 – 37 Injection of `http.<url>.*` git config settings leading to SSRF #855276 Valid Server-Side Request Forgery – 2020-09-08 $3,000 36 Store-XSS in error message of build-dependencies #950190 Valid Cross-site Scripting – 2020-12-01 – 35 Stored XSS in group issue list #859333 Valid Cross-site Scripting – 2020-11-21 $2,000 27 No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im #702987 Valid Denial of Service – 2020-05-15 – 26 Stored XSS on PyPi simple API endpoint #856836 Valid Cross-site Scripting – 2020-09-09 $3,000 25 Stealing data from customers.gitlab.com without user interaction #674195 Valid Insecure Direct Object Reference – 2020-08-26 – 25 SafeParamsHelper::safe_params is not so safe #946728 Valid Cross-site Scripting – 2020-11-02 $4,000 24 Unauthorized access to private project security dashboard #853355 Valid Information Disclosure – 2020-11-21 – 24 Possibilty to purchase Ultimate - 1 Year (EDU or OSS) #882848 Valid Input Validation and Logic – 2020-11-02 – 23 CRLF injection & SSRF in git:// protocal lead to arbitrary code execution #441090 Valid Server-Side Request Forgery – 2020-11-23 – 22 Instant open redirect on Live preview WEB Ide opening #437142 Valid Open Redirect – 2020-11-04 $1,000 20 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control – 2020-11-02 $4,000 18 Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... #960244 Valid Memory Corruption – 2020-11-02 $5,000 16 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery – 2020-08-17 – 14 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control – 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control – 2020-10-06 – 13 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery – 2020-09-08 – 12 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure – 2020-11-30 – 9 Adding everyone to the repo due to the lack of rate limit #978768 N/A Insecure Direct Object Reference – 2020-09-14 – 8 Elasticsearch leaks data through the notes scope #710006 Valid Access Control – 2020-10-06 – 8 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure – 2020-11-02 – 7 Double linking cause XSS (but blokeced by CSP in gitlab.com) #729341 N/A Cross-site Scripting – 2020-01-20 – 6 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control – 2020-09-08 – 5 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control – 2020-08-26 $3,000 4 Email notification about login email changed is not received when using verified linked email address #801973 N/A Misconfiguration and Insecure Design – 2020-03-25 – 3