# GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [GitLab: For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to…](https://agentprime.io/advisories/CVE-2020-13280.md)
  `CVE-2020-13280` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2020
- [GitLab: For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability…](https://agentprime.io/advisories/CVE-2020-13285.md)
  `CVE-2020-13285` · CVE record: GitLab GitLab · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2020
- [GitLab: For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in…](https://agentprime.io/advisories/CVE-2020-13283.md)
  `CVE-2020-13283` · CVE record: GitLab GitLab · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2020
- [GitLab: For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs…](https://agentprime.io/advisories/CVE-2020-13282.md)
  `CVE-2020-13282` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 13 Aug 2020
- [GitLab: In GitLab before 13.0.12, 13.1.6, and 13.2.3…](https://agentprime.io/advisories/CVE-2020-13290.md)
  `CVE-2020-13290` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2020
- [In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.](https://agentprime.io/advisories/CVE-2020-13291.md)
  `CVE-2020-13291` · CVE record: GitLab GitLab · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2020
- [GitLab: In GitLab before 13.0.12, 13.1.6, and 13.2.3…](https://agentprime.io/advisories/CVE-2020-13288.md)
  `CVE-2020-13288` · CVE record: GitLab GitLab · CVSS 5.5 Medium · Not analysed yet · Published 12 Aug 2020
- [GitLab: In GitLab before 13.0.12, 13.1.6 and 13.2.3…](https://agentprime.io/advisories/CVE-2020-13292.md)
  `CVE-2020-13292` · CVE record: GitLab GitLab · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2020
- [GitLab: In GitLab before 13.0.12, 13.1.6 and 13.2.3…](https://agentprime.io/advisories/CVE-2020-13294.md)
  `CVE-2020-13294` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 10 Aug 2020
- [GitLab: In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could…](https://agentprime.io/advisories/CVE-2020-13293.md)
  `CVE-2020-13293` · CVE record: GitLab GitLab · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2020
- [GitLab: An authorization issue relating to project maintainer impersonation was identified in…](https://agentprime.io/advisories/CVE-2020-13263.md)
  `CVE-2020-13263` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows…](https://agentprime.io/advisories/CVE-2020-13264.md)
  `CVE-2020-13264` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2020
- [GitLab: Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows…](https://agentprime.io/advisories/CVE-2020-13261.md)
  `CVE-2020-13261` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2020
- [GitLab: Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through…](https://agentprime.io/advisories/CVE-2020-13262.md)
  `CVE-2020-13262` · CVE record: GitLab GitLab · CVSS 6.1 Medium · Not analysed yet · Published 19 Jun 2020
- [GitLab: A user with an unverified email address could request an access to domain restricted…](https://agentprime.io/advisories/CVE-2020-13275.md)
  `CVE-2020-13275` · CVE record: GitLab GitLab · CVSS 8.0 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: A security issue allowed achieving Denial of Service attacks through memory exhaustion by…](https://agentprime.io/advisories/CVE-2020-13274.md)
  `CVE-2020-13274` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE…](https://agentprime.io/advisories/CVE-2020-13273.md)
  `CVE-2020-13273` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user…](https://agentprime.io/advisories/CVE-2020-13265.md)
  `CVE-2020-13265` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 19 Jun 2020
- [OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow](https://agentprime.io/advisories/CVE-2020-13272.md)
  `CVE-2020-13272` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: User is allowed to set an email as a notification email even without verifying the new…](https://agentprime.io/advisories/CVE-2020-13276.md)
  `CVE-2020-13276` · CVE record: GitLab GitLab · CVSS 7.4 High · Not analysed yet · Published 19 Jun 2020
- [GitLab: An authorization issue in the mirroring logic allowed read access to private repositories…](https://agentprime.io/advisories/CVE-2020-13277.md)
  `CVE-2020-13277` · CVE record: GitLab GitLab · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2020
- [GitLab: A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary…](https://agentprime.io/advisories/CVE-2020-13269.md)
  `CVE-2020-13269` · CVE record: GitLab GitLab · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2020
- [GitLab: Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through…](https://agentprime.io/advisories/CVE-2020-13270.md)
  `CVE-2020-13270` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2020
- [GitLab: A specially crafted request could be used to confirm the existence of files hosted on…](https://agentprime.io/advisories/CVE-2020-13268.md)
  `CVE-2020-13268` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2020
- [GitLab: A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads…](https://agentprime.io/advisories/CVE-2020-13267.md)
  `CVE-2020-13267` · CVE record: GitLab GitLab · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2020
- [GitLab: A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript…](https://agentprime.io/advisories/CVE-2020-13271.md)
  `CVE-2020-13271` · CVE record: GitLab GitLab · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2020
- [GitLab: Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through…](https://agentprime.io/advisories/CVE-2020-13266.md)
  `CVE-2020-13266` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 9 Jun 2020
- [Information disclosure in GitLab](https://agentprime.io/advisories/CVE-2019-15594.md)
  `CVE-2019-15594` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 14 Feb 2020 · Tags: Information disclosure
- [Information disclosure in GitLab](https://agentprime.io/advisories/CVE-2019-15592.md)
  `CVE-2019-15592` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 14 Feb 2020 · Tags: Information disclosure
- [GitLab: The (1) create_branch, (2) create_tag, (3) import_project…](https://agentprime.io/advisories/CVE-2013-4582.md)
  `CVE-2013-4582` · CVE record: GitLab GitLab and 3 more · No CVSS score · Not analysed yet · Published 28 Jan 2020
- [GitLab: The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2…](https://agentprime.io/advisories/CVE-2013-4583.md)
  `CVE-2013-4583` · CVE record: GitLab GitLab and 3 more · No CVSS score · Not analysed yet · Published 28 Jan 2020
- [Uncontrolled resource consumption in GitLab](https://agentprime.io/advisories/CVE-2019-5472.md)
  `CVE-2019-5472` · CVE record: GitLab GitLab · No CVSS score · Not analysed yet · Published 28 Jan 2020 · Tags: Denial of service
- [Information disclosure in GitLab](https://agentprime.io/advisories/CVE-2019-5470.md)
  `CVE-2019-5470` · CVE record: GitLab GitLab · No CVSS score · Not analysed yet · Published 28 Jan 2020 · Tags: Information disclosure
- [Insecure direct object reference in GitLab](https://agentprime.io/advisories/CVE-2019-5469.md)
  `CVE-2019-5469` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 18 Dec 2019 · Tags: Broken access control
- [Improper access control in GitLab](https://agentprime.io/advisories/CVE-2019-15591.md)
  `CVE-2019-15591` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 18 Dec 2019 · Tags: Broken access control
- [Uncontrolled resource consumption in GitLab](https://agentprime.io/advisories/CVE-2019-15593.md)
  `CVE-2019-15593` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 22 Nov 2019 · Tags: Denial of service
- [Cross-site scripting in GitLab](https://agentprime.io/advisories/CVE-2019-5471.md)
  `CVE-2019-5471` · CVE record: GitLab · No CVSS score · Not analysed yet · Published 9 Sept 2019 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/technology/gitlab.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gitlab&cursor=WyIyMDIwLTA4LTEzVDEzOjIyOjIzLjAwMDAwMFoiLCJDVkUtMjAyMC0xMzI4MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gitlab/?cursor=WyIyMDIwLTA4LTEzVDEzOjIyOjIzLjAwMDAwMFoiLCJDVkUtMjAyMC0xMzI4MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.