漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 257 份 · 本页赏金 $94,930 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Found Origin IP's lead to access to gitlabGitLab · 访问控制 · 2022-08-02无赏金低危
- RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)GitLab · 代码执行 · 2022-09-13 · CVE-2022-2185$33,510高危
- Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`GitLab · 访问控制 · 2022-09-22无赏金低危
- CSP-bypass XSS in project settings pageGitLab · 跨站脚本 · 2022-11-16无赏金中危
- Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)GitLab · 开放重定向 · 2022-06-22无赏金低危
- XSS: `v-safe-html` is not safe enoughGitLab · 跨站脚本 · 2022-11-16无赏金中危
- New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fieldsGitLab · 跨站脚本 · 2022-11-16 · CVE-2022-1948$13,950中危
- DOS via issue previewGitLab · 拒绝服务 · 2022-11-04$7,640中危
- DOS via move_issueGitLab · 拒绝服务 · 2022-11-04$2,300低危
- XSS in ZenTao integration affecting self hosted instances without strict CSPGitLab · 跨站脚本 · 2022-09-22无赏金中危
- Content injection in Jira issue title enabling sending arbitrary POST request as victimGitLab · 注入与走私 · 2022-09-22 · CVE-2022-1940无赏金中危
- ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a yearGitLab · 拒绝服务 · 2022-09-13无赏金低危
- Stored XSS in Notes (with CSP bypass for gitlab.com)GitLab · 跨站脚本 · 2022-05-25无赏金中危
- Container escape on public GitLab CI runnersGitLab · 访问控制 · 2022-04-27无赏金中危
- Arbitrary file read via the bulk imports UploadsPipelineGitLab · 路径遍历 · 2022-03-21$29,000高危
- Gitlab Pages token theft using service workersGitLab · 访问控制 · 2022-06-08$1,680低危
- Installing Gitlab runner with Docker-In-Docker allows root accessGitLab · 访问控制 · 2022-02-10$100未评级
- Arbitrary POST request as victim user from HTML injection in Jupyter notebooksGitLab · 注入与走私 · 2022-05-20无赏金中危
- RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedGitLab · 代码执行 · 2022-04-12$3,000未评级
- Stored XSS on issue comments and other pages which contain notesGitLab · 跨站脚本 · 2022-06-08$3,000中危
- "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge requestGitLab · 访问控制 · 2022-06-08无赏金低危
- IDOR in "external status check" API leaks data about any status check on the instanceGitLab · 不安全的直接对象引用 · 2022-02-22无赏金低危
- Drive-by arbitrary file deletion in the GDK via letter_opener_web gemGitLab · 跨站请求伪造 · 2021-11-12$750低危
- Stored XSS in merge request creation page through payload in approval rule nameGitLab · 跨站脚本 · 2022-03-31无赏金中危
- Improper access control for users with expired password, giving the user full access through API and GitGitLab · 访问控制 · 2022-01-27无赏金低危