An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.

An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link

Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content

An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.

An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.

GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.

GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.

GitLab EE 10.1 through 12.7.2 allows Information Disclosure.

GitLab through 12.7.2 allows XSS.

GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).