Vulnerabilidades en GitLab

1129 resultados
Análisis Vexday

Com 1.068 CVEs catalogadas e 78 novas surgidas nos últimos 90 dias, o GitLab apresenta um volume de vulnerabilidades que exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com 4 CVEs confirmadas em uso por agentes de ameaça, mas a presença de 83 vulnerabilidades com prova de conceito pública e 24 de severidade crítica amplia consideravelmente a superfície de risco. O destaque mais preocupante é CVE-2021-22205, atualmente a CVE mais perigosa em exploração ativa, com EPSS de 0,9973 — valor que indica probabilidade altíssima de exploração —, e cuja falha de tipo mais recorrente na plataforma, CWE-770 (alocação de recursos sem limites adequados), sugere atenção redobrada a controles de validação de entrada e gestão de recursos. Equipes de segurança devem priorizar a remediação das CVEs com PoC disponível e manter rastreamento próximo das novas emissões, dado o ritmo relevante de descobertas recentes.

CVE-2023-5332MEDIUMDependency on Vulnerable Third-Party Component in GitLabEPSS 0.7%CVE-2021-22220MEDIUMAn issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of nEPSS 0.7%CVE-2025-13928HIGHIncorrect Authorization in GitLabEPSS 0.7%CVE-2021-39918LOWIncorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4,EPSS 0.7%CVE-2023-4647MEDIUMAllocation of Resources Without Limits or Throttling in GitLabEPSS 0.7%CVE-2023-0838MEDIUMAn issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A EPSS 0.7%CVE-2022-4342MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 beforeEPSS 0.7%CVE-2021-22262MEDIUMMissing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versEPSS 0.7%CVE-2021-22256MEDIUMImproper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track thEPSS 0.7%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2023-2181MEDIUMAn issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A maliciousEPSS 0.7%CVE-2020-26407MEDIUMA XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to peEPSS 0.7%CVE-2020-13265MEDIUMUser email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verificationEPSS 0.7%CVE-2022-3820MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not pEPSS 0.7%CVE-2022-3902MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5EPSS 0.7%CVE-2023-3993MEDIUMInsertion of Sensitive Information into Log File in GitLabEPSS 0.7%CVE-2022-2865HIGHA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3EPSS 0.7%CVE-2026-88765HIGHImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabEPSS 0.7%CVE-2022-1189LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 beforeEPSS 0.7%CVE-2022-2500MEDIUMA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior EPSS 0.7%