Mike12

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.9 and later Description: An issue has been discovered in GitLab where it is vulnerable to a stored XSS if scoped labels were used. Recommendations: For GitLab versions 12.9 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.8 and later Description: An issue has been discovered in GitLab, where it is vulnerable to a stored XSS in the epics page. This issue could be exploited with user interactions. Recommendations: For GitLab versions 11.8 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 11.8 through 12.10.13 **Description** An issue has been discovered in GitLab, where it was vulnerable to a stored XSS in the error tracking feature. **Recommendations** For versions 11.8 through 12.10.13, update to version 12.10.13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GitLab versions prior to 13.0.12 GitLab versions prior to 13.1.6 GitLab versions prior to 13.2.3 **Description** A cross-site scripting issue exists in the issues list via milestone title. **Recommendations** For versions prior to 13.0.12, update to version 13.0.12 or later. For versions prior to 13.1.6, update to version 13.1.6 or later. For versions prior to 13.2.3, update to version 13.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 12.1 through 12.8.1 **Description** A stored cross-site scripting issue was found when displaying merge requests, allowing for XSS attacks. **Recommendations** For versions 12.1 through 12.8.1, update to a version that contains a fix for this issue to prevent stored cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 9.3 through 12.8.1 **Description** A cross-site scripting issue was found when viewing particular file types, allowing for potential exploitation. **Recommendations** For versions 9.3 through 12.8.1, update to a version later than 12.8.1 to resolve the issue.