A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
End of life: 3/22/2022, End of support: 1/22/2022, Latest version: 14.6.7
End of life: 3/22/2022, End of support: 1/22/2022, Latest version: 14.6.7