Remote Command Execution via Github import Analysed #1679624 Valid Command and Code Injection – 2022-10-06 $33,510 392 RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) Analysed #1609965 Valid Command and Code Injection – 2022-09-13 $33,510 387 Arbitrary file read via the bulk imports UploadsPipeline Analysed #1439593 Valid File and Path Handling – 2022-03-21 $29,000 329 RCE via github import #1672388 Valid Command and Code Injection – 2022-11-16 – 271 Steal private objects of other projects via project import Analysed #743953 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 254 Stored XSS in Notes (with CSP bypass for gitlab.com) Analysed #1481207 Valid Cross-site Scripting – 2022-05-25 – 161 Path traversal, to RCE Analysed #733072 Valid Command and Code Injection – 2022-06-07 $12,000 142 Private objects exposed through project import Analysed #767770 Valid Insecure Direct Object Reference – 2022-06-07 $20,000 133 Able to view hackerone reports attachments #979787 Valid Information Disclosure – 2022-07-11 – 103 CSP-bypass XSS in project settings page #1588732 Valid Cross-site Scripting – 2022-11-16 – 100 New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields #1578400 Valid Cross-site Scripting – 2022-11-16 $13,950 93 RepositoryPipeline allows importing of local git repos #1685822 Valid Access Control – 2022-11-04 $22,300 89 Path traversal in Nuget Package Registry #822262 Valid File and Path Handling – 2022-06-07 $12,000 88 XSS in ZenTao integration affecting self hosted instances without strict CSP #1542510 Valid Cross-site Scripting – 2022-09-22 – 81 Content injection in Jira issue title enabling sending arbitrary POST request as victim #1533976 Valid Injection and Smuggling – 2022-09-22 – 55 Arbitrary POST request as victim user from HTML injection in Jupyter notebooks #1409788 Valid Injection and Smuggling – 2022-05-20 – 54 RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed #1401444 Valid Command and Code Injection – 2022-04-12 $3,000 50 Improper access control for users with expired password, giving the user full access through API and Git #1285226 Valid Access Control – 2022-01-27 – 49 XSS: `v-safe-html` is not safe enough #1579645 Valid Cross-site Scripting – 2022-11-16 – 43 Stored XSS on issue comments and other pages which contain notes #1398305 Valid Cross-site Scripting – 2022-06-08 $3,000 38 Exposure of a valid Gitlab-Workhorse JWT leading to various bad things #1040786 Valid Authentication – 2022-07-05 $10,000 36 IDOR in "external status check" API leaks data about any status check on the instance #1372216 Valid Insecure Direct Object Reference – 2022-02-22 – 35 Stored XSS in merge request creation page through payload in approval rule name #1342009 Valid Cross-site Scripting – 2022-03-31 – 32 Stored XSS in repository file viewer #1072868 Valid Cross-site Scripting – 2022-05-19 $2,000 29 DOS via issue preview #1543718 Valid Denial of Service – 2022-11-04 $7,640 25 Stored XSS for Grafana dashboard URL #684268 Valid Cross-site Scripting – 2022-07-13 – 21 DOS via move_issue #1543584 Valid Denial of Service – 2022-11-04 $2,300 19 Unauthorized access #1669176 Informative Access Control – 2022-08-25 – 18 Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io` #1591412 Valid Access Control – 2022-09-22 – 17 Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances #970869 Valid Command and Code Injection – 2022-02-10 – 15 Gitlab Pages token theft using service workers #1439552 Valid Access Control – 2022-06-08 $1,680 14 "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request #1375393 Valid Access Control – 2022-06-08 – 13 Container escape on public GitLab CI runners #1442118 Informative Access Control – 2022-04-27 – 12 XSS by clicking Jira's link #1194254 Valid Cross-site Scripting – 2022-06-08 $1,130 12 ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year #1531958 Valid Denial of Service – 2022-09-13 – 9 Installing Gitlab runner with Docker-In-Docker allows root access #1417211 Valid Access Control – 2022-02-10 $100 9 Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net #1643962 Valid Information Disclosure – 2022-11-04 – 8 Bypass for Domain-level redirects (Unvalidated Redirects and Forwar) #1582160 Informative Open Redirect – 2022-06-22 – 7 Dependecy Confusion via Lookup Request Forwarding to PyPi.org #1681275 Informative Misconfiguration and Insecure Design – 2022-11-21 – 6 Found Origin IP's lead to access to gitlab #1637577 Informative Access Control – 2022-08-02 – 6 No Restriction on password #1696814 N/A No weakness recorded – 2022-09-13 – 2