HexBrain
Sign in

Browse / GitLab

GitLab

257disclosed reports
$594,110paid in bounties

See its reports on the map

What gets reported to GitLab

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Arbitrary file read via the UploadsRewriter when moving and issuePath Traversal · critical
    $20,0001,503 votes
  2. Account Takeover via Password Reset without user interactionsImproper Access Control - Generic · critical
    $35,000989 votes
  3. Git flag injection - local file overwrite to remote code executionCommand Injection - Generic · critical
    $12,000777 votes
  4. Exfiltrate and mutate repository and project data through injected templated serviceImproper Access Control - Generic · critical
    $11,000762 votes
  5. Stored XSS in Wiki pagesCross-site Scripting (XSS) - Stored · high
    633 votes
  6. Local files could be overwritten in GitLab, leading to remote command executionCommand Injection - Generic · critical
    $12,000542 votes
  7. RCE when removing metadata with ExifToolCode Injection · critical
    $20,000508 votes
  8. Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsPrivilege Escalation · critical
    $12,000457 votes
  9. RCE via unsafe inline Kramdown options when rendering certain Wiki pagesCode Injection · critical
    $20,000427 votes
  10. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readInformation Disclosure · critical
    $10,000410 votes
  11. Remote Command Execution via Github importCommand Injection - Generic · critical
    $33,510392 votes
  12. RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Command Injection - Generic · critical
    $33,510387 votes
  13. JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsInformation Disclosure · critical
    $12,000366 votes
  14. Bypass of GitLab CI runner slash fix in YAML validationImproper Input Validation · critical
    363 votes
  15. SSRF on project import via the remote_attachment_url on a NoteServer-Side Request Forgery (SSRF) · high
    $10,000359 votes
  16. Attacker is able to access commit title and team member comments which are supposed to be privateImproper Access Control - Generic · high
    351 votes
  17. Server Side Request Forgery mitigation bypassServer-Side Request Forgery (SSRF) · high
    350 votes
  18. Arbitrary file read via the bulk imports UploadsPipelinePath Traversal · critical
    $29,000329 votes
  19. Stored XSS in markdown via the DesignReferenceFilter Cross-site Scripting (XSS) - Stored · critical
    $16,000317 votes
  20. An attacker can run pipeline jobs as arbitrary userBusiness Logic Errors · critical
    $12,000307 votes
  21. Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.comIncorrect Authorization · critical
    306 votes
  22. Stored XSS via Kroki diagramCross-site Scripting (XSS) - Stored · high
    $13,950295 votes
  23. Cross-site Scripting (XSS) - Stored in RDoc wiki pagesUI Redressing (Clickjacking) · high
    $3,500282 votes
  24. RCE via github importOS Command Injection · critical
    271 votes
  25. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high
    $3,000257 votes
  26. Privilege escalation from any user (including external) to gitlab admin when admin impersonates youPrivilege Escalation · critical
    256 votes
  27. Steal private objects of other projects via project importInsecure Direct Object Reference (IDOR) · critical
    $20,000254 votes
  28. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainReliance on Untrusted Inputs in a Security Decision · medium
    249 votes
  29. Unauthenticated blind SSRF in OAuth Jira authorization controllerServer-Side Request Forgery (SSRF) · high
    $4,000238 votes
  30. Full Read SSRF on Gitlab's Internal GrafanaServer-Side Request Forgery (SSRF) · critical
    229 votes
  31. Ability To Delete User(s) Account Without User InteractionMisconfiguration · high
    221 votes
  32. Group search leaks private MRs, code, commitsImproper Access Control - Generic · high
    212 votes
  33. Arbitrary file read during project importPath Traversal · critical
    $16,000194 votes
  34. Stored-XSS with CSP-bypass via labels' colorCross-site Scripting (XSS) - Stored · high
    169 votes
  35. Git flag injection leading to file overwrite and potential remote code executionCommand Injection - Generic · critical
    $3,500169 votes
  36. Snippet JS template allows attacker to read a user's private snippetsInformation Disclosure · low
    $300165 votes
  37. Stored XSS in Notes (with CSP bypass for gitlab.com)Cross-site Scripting (XSS) - Stored · high
    161 votes
  38. Importing GitLab project archives can replace uploads of other usersInsecure Direct Object Reference (IDOR) · high
    148 votes
  39. information disclosure of secret_key_base via encoding charctersInformation Exposure Through an Error Message · high
    $3,500146 votes
  40. DoS on the Issue page by exploiting Mermaid.Uncontrolled Resource Consumption · medium
    $3,000145 votes
  41. Path traversal, to RCECommand Injection - Generic · high
    $12,000142 votes
  42. Mint Oauth2 access token for targeted userImproper Authentication - Generic · high
    $5,580140 votes
  43. Persistent XSS in Note objectsCross-site Scripting (XSS) - Stored · high
    $4,500139 votes
  44. Send arbitrary PUT requests when user clicks on a linkCommand Injection - Generic · medium
    135 votes
  45. Private objects exposed through project importInsecure Direct Object Reference (IDOR) · critical
    $20,000133 votes
  46. Stored XSS in custom emojiCross-site Scripting (XSS) - Stored · high
    $3,000130 votes
  47. Git flag injection - Search API with scope 'blobs' Command Injection - Generic · high
    $7,000130 votes
  48. IDOR Exposes All Machine Learning ModelsInsecure Direct Object Reference (IDOR) · medium
    $1,160117 votes
  49. Read files on application server, leads to RCEInformation Disclosure · critical
    114 votes
  50. Able to view hackerone reports attachmentsInsecure Storage of Sensitive Information · critical
    103 votes
  51. CSP-bypass XSS in project settings pageCross-site Scripting (XSS) - Generic · high
    100 votes
  52. Group search with Elastic search enable leaks unrelated dataImproper Access Control - Generic · high
    100 votes
  53. Account takeover due to insufficient URL validation on RelayState parameterCross-Site Request Forgery (CSRF) · medium
    $2,45099 votes
  54. Bypass: Stored-XSS with CSP-bypass via scoped labels' colorCross-site Scripting (XSS) - Stored · high
    96 votes
  55. XSS in request approvalsCross-site Scripting (XSS) - Stored · medium
    $3,00096 votes
  56. New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsCross-site Scripting (XSS) - Stored · high
    $13,95093 votes
  57. Unrestricted file upload leads to Stored XSSCross-site Scripting (XSS) - Stored · medium
    90 votes
  58. RepositoryPipeline allows importing of local git reposImproper Access Control - Generic · medium
    $22,30089 votes
  59. Stored XSS in "Create Groups"Cross-site Scripting (XSS) - Stored · high
    $2,50089 votes
  60. CSRF on /api/graphql allows executing mutations through GET requestsCross-Site Request Forgery (CSRF) · high
    $3,37088 votes
  61. Path traversal in Nuget Package RegistryPath Traversal · high
    $12,00088 votes
  62. DoS attack via comment on IssueUncontrolled Resource Consumption · low
    $1,00084 votes
  63. Cache poisoning Denial of Service affecting assets.gitlab-static.netUncontrolled Resource Consumption · high
    83 votes
  64. XSS in ZenTao integration affecting self hosted instances without strict CSPCross-site Scripting (XSS) - Generic · high
    81 votes
  65. Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"Cross-site Scripting (XSS) - Stored · high
    80 votes
  66. Subdomain takeover in Gitlab pagesMisconfiguration · low
    79 votes
  67. GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command InjectionOS Command Injection · high
    77 votes
  68. Remove obsolete domain from handbook subdomainMisconfiguration · low
    72 votes
  69. GitLab::UrlBlocker validation bypass leading to full Server Side Request ForgeryServer-Side Request Forgery (SSRF) · high
    72 votes
  70. SSRF in CI after first runServer-Side Request Forgery (SSRF) · medium
    72 votes
  71. Stored-XSS injected in Wiki page via Banzai pipelineCross-site Scripting (XSS) - Stored · high
    71 votes
  72. Login email verification bypass via `/oauth/token`.InformativeMissing Critical Step in Authentication
    66 votes
  73. Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenPrivilege Escalation · medium
    66 votes
  74. DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverUncontrolled Resource Consumption · medium
    $2,30064 votes
  75. GraphQL query "namespace" leaks dataImproper Access Control - Generic · medium
    64 votes
  76. HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressResource Injection · low
    $1,06061 votes
  77. Ability to access all user authentication tokens, leads to RCEPrivilege Escalation · critical
    61 votes
  78. [Admin Panel] CSRF to resume/pause runnerCross-Site Request Forgery (CSRF) · low
    60 votes
  79. Stored-XSS on wiki pagesCross-site Scripting (XSS) - Stored · medium
    59 votes
  80. Stored XSS via Mermaid Prototype Pollution vulnerabilityCross-site Scripting (XSS) - Stored · high
    $3,00058 votes
  81. FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comServer-Side Request Forgery (SSRF) · high
    58 votes
  82. Know whether private project name exists or not within a group using link commentsInformation Disclosure · low
    58 votes
  83. Content injection in Jira issue title enabling sending arbitrary POST request as victimResource Injection · high
    55 votes
  84. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high
    55 votes
  85. EXIF metadata not stripped from JPG group logosInformation Disclosure · low
    $50055 votes
  86. Arbitrary POST request as victim user from HTML injection in Jupyter notebooksResource Injection · high
    54 votes
  87. Access to GitLab's Slack by abusing issue creation from e-mailImproper Authentication - Generic · critical
    54 votes
  88. Stored XSS in merge request pagesCross-site Scripting (XSS) - Stored · high
    $3,50053 votes
  89. All functions that allow users to specify color code are vulnerable to ReDoSUncontrolled Resource Consumption · low
    $1,00053 votes
  90. Change project visibility to a restricted optionViolation of Secure Design Principles · medium
    $1,37051 votes
  91. RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedOS Command Injection
    $3,00050 votes
  92. Stored XSS on the job pageCross-site Scripting (XSS) - Stored · high
    $3,00050 votes
  93. Stored XSS in markdown when redacting referencesCross-site Scripting (XSS) - Stored · high
    $5,00050 votes
  94. Clientside resource Exhausting by exploiting gitlab math rendering Uncontrolled Resource Consumption · low
    50 votes
  95. Command injection by overwriting authorized_keys file through GitLab importCommand Injection - Generic · critical
    $2,00050 votes
  96. Improper access control for users with expired password, giving the user full access through API and GitImproper Access Control - Generic · medium
    49 votes
  97. Guest users can create new test casesPrivilege Escalation · medium
    $65049 votes
  98. XSS on Issue reference numbersCross-site Scripting (XSS) - DOM · medium
    49 votes
  99. View the Starred Projects in a Private ProfileInsecure Direct Object Reference (IDOR) · low
    $50049 votes
  100. Stored XSS via Mermaid Prototype Pollution vulnerabilityCross-site Scripting (XSS) - Stored · high
    $3,00048 votes