Advisories · Technology

GitLab.

Every CVE that names GitLab among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-12244 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 24 Apr 2025
CVE-2025-0639 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 24 Apr 2025
CVE-2025-1908 CVE record

CVSS 7.7 High

Business Logic Errors in GitLab
- GitLab
- CWE-840
Not analysed yet 24 Apr 2025
CVE-2025-0362 CVE record

CVSS 6.4 Medium

Improper Restriction of Rendered UI Layers or Frames in GitLab
- GitLab
- CWE-1021
Not analysed yet 10 Apr 2025
CVE-2025-2469 CVE record

CVSS 3.7 Low

Debug Messages Revealing Unnecessary Information in GitLab
- GitLab
- CWE-1295
Not analysed yet 10 Apr 2025
CVE-2024-11129 CVE record

CVSS 6.3 Medium

Generation of Error Message Containing Sensitive Information in GitLab
- GitLab
- Information disclosure
Not analysed yet 10 Apr 2025
CVE-2025-1677 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 10 Apr 2025
CVE-2025-2408 CVE record

CVSS 5.3 Medium

Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
Not analysed yet 10 Apr 2025
CVE-2024-10307 CVE record

CVSS 4.3 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 28 Mar 2025
CVE-2024-12619 CVE record

CVSS 5.2 Medium

Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
Not analysed yet 28 Mar 2025
CVE-2025-2867 CVE record

CVSS 4.4 Medium

Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
Not analysed yet 27 Mar 2025
CVE-2024-9773 CVE record

CVSS 3.7 Low

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- GitLab
- Command injection
Not analysed yet 27 Mar 2025
CVE-2025-0811 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2025
CVE-2025-2242 CVE record

CVSS 7.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 27 Mar 2025
CVE-2025-2255 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2025
CVE-2024-7296 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Mar 2025
CVE-2025-1257 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 13 Mar 2025
CVE-2024-8402 CVE record

CVSS 3.7 Low

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- GitLab
- Command injection
Not analysed yet 13 Mar 2025
CVE-2024-12380 CVE record

CVSS 4.4 Medium

Generation of Error Message Containing Sensitive Information in GitLab
- GitLab
- Information disclosure
Not analysed yet 13 Mar 2025
CVE-2024-13054 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 13 Mar 2025
CVE-2025-0652 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Mar 2025
CVE-2025-2045 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 6 Mar 2025
CVE-2025-1540 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 6 Mar 2025
CVE-2025-0555 CVE record

CVSS 7.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-10925 CVE record

CVSS 5.3 Medium

Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
Not analysed yet 3 Mar 2025
CVE-2025-0475 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-8186 CVE record

CVSS 5.4 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 3 Mar 2025
CVE-2024-3303 CVE record

CVSS 6.4 Medium

Improper Neutralization of Input Used for LLM Prompting in GitLab
- GitLab
- CWE-1427
Not analysed yet 13 Feb 2025
CVE-2025-1198 CVE record

CVSS 4.2 Medium

Insufficient Session Expiration in GitLab
- GitLab
- Authentication bypass
Not analysed yet 13 Feb 2025
CVE-2024-7102 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Execution with Unnecessary Privileges in GitLab
- GitLab
- Privilege escalation
Not analysed yet 13 Feb 2025
CVE-2024-8266 CVE record

CVSS 4.4 Medium

Execution with Unnecessary Privileges in GitLab
- GitLab
- Privilege escalation
Not analysed yet 13 Feb 2025
CVE-2024-9870 CVE record

CVSS 4.3 Medium

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
- GitLab
- CWE-441
Not analysed yet 12 Feb 2025
CVE-2025-0516 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 12 Feb 2025
CVE-2024-12379 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 12 Feb 2025
CVE-2025-0376 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 12 Feb 2025
CVE-2025-1212 CVE record

CVSS 4.3 Medium

Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
- GitLab
- Information disclosure
Not analysed yet 12 Feb 2025
CVE-2025-1042 CVE record

CVSS 4.9 Medium

Files or Directories Accessible to External Parties in GitLab
- GitLab
- Information disclosure
Not analysed yet 12 Feb 2025
CVE-2025-1072 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 7 Feb 2025
CVE-2024-2878 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 5 Feb 2025
CVE-2024-3976 CVE record

CVSS 6.5 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 5 Feb 2025
CVE-2024-5528 CVE record

CVSS 3.5 Low

Incomplete Comparison with Missing Factors in GitLab
- GitLab
- CWE-1023
Not analysed yet 5 Feb 2025
CVE-2024-9631 CVE record

CVSS 7.5 High

Inefficient Algorithmic Complexity in GitLab
- GitLab
- Denial of service
Not analysed yet 5 Feb 2025
CVE-2024-6356 CVE record

CVSS 4.4 Medium

Incorrect User Management in GitLab
- GitLab
- CWE-286
Not analysed yet 5 Feb 2025
CVE-2024-1539 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 5 Feb 2025
CVE-2023-6386 CVE record

CVSS 6.5 Medium

Allocation of Resources Without Limits or Throttling in GitLab
- GitLab
- Denial of service
Not analysed yet 5 Feb 2025
CVE-2023-6195 CVE record

CVSS 2.6 Low

Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
Not analysed yet 30 Jan 2025
CVE-2024-1211 CVE record

CVSS 6.4 Medium

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 30 Jan 2025
CVE-2025-0290 CVE record

CVSS 4.3 Medium

Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
- GitLab
- Denial of service
Not analysed yet 28 Jan 2025
CVE-2024-11931 CVE record

CVSS 6.4 Medium

Insufficient Granularity of Access Control in GitLab
- GitLab
- CWE-1220
Not analysed yet 24 Jan 2025
CVE-2025-0314 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 24 Jan 2025
CVE-2024-13041 CVE record

CVSS 4.2 Medium

Incorrect User Management in GitLab
- GitLab
- CWE-286
Not analysed yet 9 Jan 2025
CVE-2024-6324 CVE record

CVSS 4.3 Medium

Inefficient Algorithmic Complexity in GitLab
- GitLab
- Denial of service
Not analysed yet 9 Jan 2025
CVE-2024-12431 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 8 Jan 2025
CVE-2025-0194 CVE record

CVSS 6.5 Medium

Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
- GitLab
- Information disclosure
Not analysed yet 8 Jan 2025
CVE-2023-5117 CVE record

CVSS 3.7 Low

Exposure of Sensitive Information Due to Incompatible Policies in GitLab
- GitLab
- CWE-213
Not analysed yet 25 Dec 2024
CVE-2024-8116 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Dec 2024
CVE-2024-8650 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 16 Dec 2024
CVE-2024-8179 CVE record

CVSS 5.4 Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 12 Dec 2024
CVE-2024-8233 CVE record

CVSS 7.5 High

Inefficient Algorithmic Complexity in GitLab
- GitLab
- Denial of service
Not analysed yet 12 Dec 2024
CVE-2024-8647 CVE record

CVSS 5.4 Medium

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- GitLab
- Path traversal
Not analysed yet 12 Dec 2024