GitLab, a premier platform for DevOps and continuous integration/continuous delivery has rolled out essential security updates in versions 17.4.2, 17.3.5 and 17.2.9 for both community Edition (CE) and enterprises edition (EE). These updates tackles several important vulnerabilities, notably a critical severity flaw (CVE: 2024-9164) that could enable attackers to execute pipelines on arbitrary branches, posing a significant security threat to impacted instances.
The critical vulnerability identified as CVE:2024-9164 impacts all versions of GitLab Enterprise Edition from 12.5 onward. This flaw enables malicious actors to execute pipeline across any branch, posing a significant risk of unauthenticated access to sensitive data and system. With a CVSS score of 9.6, this issue is recognized as highly severe.
By infosecbulletin
/ Tuesday , April 1 2025
Israeli cybersecurity firm Check Point has responded to a hacker who claimed to have stolen valuable information from its systems....
Read More
By infosecbulletin
/ Tuesday , April 1 2025
Apple has issued an urgent security advisory about 3 critical zero-day vulnerabilities—CVE-2025-24200, CVE-2025-24201, and CVE-2025-24085—that are being actively exploited in...
Read More
By infosecbulletin
/ Tuesday , April 1 2025
GreyNoise has detected a sharp increase in login scanning aimed at Palo Alto Networks PAN-OS GlobalProtect portals. In the past...
Read More
By infosecbulletin
/ Monday , March 31 2025
Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
By infosecbulletin
/ Sunday , March 30 2025
RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
By infosecbulletin
/ Sunday , March 30 2025
Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
By infosecbulletin
/ Sunday , March 30 2025
Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
By infosecbulletin
/ Saturday , March 29 2025
The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
By infosecbulletin
/ Thursday , March 27 2025
OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
By infosecbulletin
/ Thursday , March 27 2025
Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Other significant vulnerabilities addressed in this update include:
CVE-2024-8970: Let attackers pretend to be other users in certain situations, which could result in unauthorized actions and data leaks.
CVE-2024-8977: A security flaw that allows attacker to access internal resources and services through the Analytins Dashboard.
CVE-2024-9631: Checking code changes in merge requests with conflicts can be slow, causing a denial of services (DoS) condition.
CVE-2024-6530: A vulnerability that lets attackers run harmful scripts and steal user information.
GitLab has fixed vulnerabilities in versions 17.4.2, 17.3.5 and 17.2.9 for both Community and Enterprise Editions. Users should upgrade to one of these versions right away.
Related topics
Lumma C2 malware attack Bangladeshi several websites
Bangladeshi 32.4% government websites face cyber attack: NAS report