# GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2024-1451.md)
  `CVE-2024-1451` · CVE record: GitLab GitLab · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 21 Feb 2024 · Tags: Cross-site scripting (XSS)
- [Authentication Bypass Using an Alternate Path or Channel in GitLab](https://agentprime.io/advisories/CVE-2024-1525.md)
  `CVE-2024-1525` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: Authentication bypass
- [Direct Request ('Forced Browsing') in GitLab](https://agentprime.io/advisories/CVE-2024-0861.md)
  `CVE-2024-0861` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Feb 2024 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3509.md)
  `CVE-2023-3509` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 21 Feb 2024 · Tags: Broken access control
- [Privilege Chaining in GitLab](https://agentprime.io/advisories/CVE-2024-1250.md)
  `CVE-2024-1250` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 12 Feb 2024 · Tags: Privilege escalation
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-6564.md)
  `CVE-2023-6564` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Broken access control
- [Inefficient Regular Expression Complexity in GitLab](https://agentprime.io/advisories/CVE-2023-6736.md)
  `CVE-2023-6736` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Denial of service
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-6840.md)
  `CVE-2023-6840` · CVE record: GitLab GitLab · CVSS 6.7 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2024-1066.md)
  `CVE-2024-1066` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Denial of service
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5612.md)
  `CVE-2023-5612` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: Broken access control
- [Inefficient Regular Expression Complexity in GitLab](https://agentprime.io/advisories/CVE-2023-6159.md)
  `CVE-2023-6159` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: Denial of service
- [Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab](https://agentprime.io/advisories/CVE-2023-5933.md)
  `CVE-2023-5933` · CVE record: GitLab GitLab · CVSS 6.4 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Direct Request ('Forced Browsing') in GitLab](https://agentprime.io/advisories/CVE-2024-0456.md)
  `CVE-2024-0456` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 26 Jan 2024 · Tags: Broken access control
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab](https://agentprime.io/advisories/CVE-2024-0402.md)
  `CVE-2024-0402` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2024 · Tags: Path traversal
- [Improper Verification of Cryptographic Signature in GitLab](https://agentprime.io/advisories/CVE-2023-2030.md)
  `CVE-2023-2030` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 12 Jan 2024 · Tags: Weak cryptography or TLS
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4812.md)
  `CVE-2023-4812` · CVE record: GitLab GitLab · CVSS 7.6 High · Not analysed yet · Published 12 Jan 2024 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5356.md)
  `CVE-2023-5356` · CVE record: GitLab GitLab · CVSS 7.3 High · Not analysed yet · Published 12 Jan 2024 · Tags: Broken access control
- [Weak Password Recovery Mechanism for Forgotten Password in GitLab](https://agentprime.io/advisories/CVE-2023-7028.md)
  `CVE-2023-7028` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.94 · Not analysed yet · Published 12 Jan 2024 · Tags: CWE-640
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-6955.md)
  `CVE-2023-6955` · CVE record: GitLab GitLab · CVSS 6.6 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: Broken access control
- [Improper User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3907.md)
  `CVE-2023-3907` · CVE record: GitLab GitLab · CVSS 4.9 Medium · Not analysed yet · Published 17 Dec 2023 · Tags: CWE-286
- [Improper Validation of Specified Type of Input in GitLab](https://agentprime.io/advisories/CVE-2023-3904.md)
  `CVE-2023-3904` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: CWE-1287
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5061.md)
  `CVE-2023-5061` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: Broken access control
- [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2023-5512.md)
  `CVE-2023-5512` · CVE record: GitLab GitLab · CVSS 4.8 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: Code injection
- [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2023-6051.md)
  `CVE-2023-6051` · CVE record: GitLab GitLab · CVSS 5.7 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: Code injection
- [Improper Certificate Validation in GitLab](https://agentprime.io/advisories/CVE-2023-6680.md)
  `CVE-2023-6680` · CVE record: GitLab GitLab · CVSS 7.4 High · Not analysed yet · Published 15 Dec 2023 · Tags: Weak cryptography or TLS
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3511.md)
  `CVE-2023-3511` · CVE record: GitLab GitLab · CVSS 2.0 Low · Not analysed yet · Published 15 Dec 2023 · Tags: Broken access control
- [Dependency on Vulnerable Third-Party Component in GitLab](https://agentprime.io/advisories/CVE-2023-5332.md)
  `CVE-2023-5332` · CVE record: GitLab GitLab · CVSS 5.9 Medium · Not analysed yet · Published 4 Dec 2023 · Tags: CWE-1395
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3443.md)
  `CVE-2023-3443` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 1 Dec 2023 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3964.md)
  `CVE-2023-3964` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: Broken access control
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2023-3949.md)
  `CVE-2023-3949` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: Information disclosure
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4317.md)
  `CVE-2023-4317` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4658.md)
  `CVE-2023-4658` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 1 Dec 2023 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2023-4912.md)
  `CVE-2023-4912` · CVE record: GitLab GitLab · CVSS 2.6 Low · Not analysed yet · Published 1 Dec 2023 · Tags: Denial of service
- [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2023-5226.md)
  `CVE-2023-5226` · CVE record: GitLab GitLab · CVSS 4.8 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: Code injection
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2023-6033.md)
  `CVE-2023-6033` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 1 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5995.md)
  `CVE-2023-5995` · CVE record: GitLab GitLab · CVSS 4.4 Medium · Not analysed yet · Published 1 Dec 2023 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4379.md)
  `CVE-2023-4379` · CVE record: GitLab GitLab · CVSS 8.1 High · Not analysed yet · Published 9 Nov 2023 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4700.md)
  `CVE-2023-4700` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 6 Nov 2023 · Tags: Broken access control
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2023-5963.md)
  `CVE-2023-5963` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 6 Nov 2023 · Tags: Denial of service
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2023-3399.md)
  `CVE-2023-3399` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 6 Nov 2023 · Tags: Information disclosure
- [Inefficient Regular Expression Complexity in GitLab](https://agentprime.io/advisories/CVE-2023-3909.md)
  `CVE-2023-3909` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: Denial of service
- [Allocation of Resources Without Limits or Throttling in GitLab](https://agentprime.io/advisories/CVE-2023-3246.md)
  `CVE-2023-3246` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: Denial of service
- [Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab](https://agentprime.io/advisories/CVE-2023-5825.md)
  `CVE-2023-5825` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: Denial of service
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2023-5831.md)
  `CVE-2023-5831` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 6 Nov 2023 · Tags: Information disclosure
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5106.md)
  `CVE-2023-5106` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2023 · Tags: Broken access control
- [Execution with Unnecessary Privileges in GitLab](https://agentprime.io/advisories/CVE-2023-5207.md)
  `CVE-2023-5207` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2023 · Tags: Privilege escalation
- [Insertion of Sensitive Information Into Sent Data in GitLab](https://agentprime.io/advisories/CVE-2023-3413.md)
  `CVE-2023-3413` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: Information disclosure
- [URL Redirection to Untrusted Site ('Open Redirect') in GitLab](https://agentprime.io/advisories/CVE-2023-3922.md)
  `CVE-2023-3922` · CVE record: GitLab GitLab · CVSS 3.0 Low · Not analysed yet · Published 29 Sept 2023 · Tags: Open redirect
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5198.md)
  `CVE-2023-5198` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: Broken access control
- [Improper Ownership Management in GitLab](https://agentprime.io/advisories/CVE-2023-0989.md)
  `CVE-2023-0989` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-282
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-2233.md)
  `CVE-2023-2233` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 29 Sept 2023 · Tags: Broken access control
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3115.md)
  `CVE-2023-3115` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-286
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3920.md)
  `CVE-2023-3920` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: Broken access control
- [Improper Validation of Specified Type of Input in GitLab](https://agentprime.io/advisories/CVE-2023-3917.md)
  `CVE-2023-3917` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-1287
- [Incorrect User Management in GitLab](https://agentprime.io/advisories/CVE-2023-3914.md)
  `CVE-2023-3914` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-286
- [Improper Validation of Specified Type of Input in GitLab](https://agentprime.io/advisories/CVE-2023-3906.md)
  `CVE-2023-3906` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 29 Sept 2023 · Tags: CWE-1287
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-3979.md)
  `CVE-2023-3979` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 29 Sept 2023 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4532.md)
  `CVE-2023-4532` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2023 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-5009.md)
  `CVE-2023-5009` · CVE record: GitLab GitLab · CVSS 8.2 High · Not analysed yet · Published 19 Sept 2023 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2023-4630.md)
  `CVE-2023-4630` · CVE record: GitLab GitLab · CVSS 5.0 Medium · Not analysed yet · Published 11 Sept 2023 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/technology/gitlab.md>
Older: <https://agentprime.io/advisories/technology/gitlab.md?cursor=WyIyMDIzLTA5LTExVDEzOjAxOjAyLjUxOTAwMFoiLCJDVkUtMjAyMy00NjMwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gitlab&cursor=WyIyMDI0LTAyLTIxVDIzOjMwOjU5Ljc5MjAwMFoiLCJDVkUtMjAyNC0wNDEwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gitlab/?cursor=WyIyMDI0LTAyLTIxVDIzOjMwOjU5Ljc5MjAwMFoiLCJDVkUtMjAyNC0wNDEwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.