InfoSecBulletin Cybersecurity for mankind
GitLab, a premier platform for DevOps and continuous integration/continuous delivery has rolled out essential security updates in versions 17.4.2, 17.3.5 and 17.2.9 for both community Edition (CE) and enterprises edition (EE). These updates tackles several important vulnerabilities, notably a critical severity flaw (CVE: 2024-9164) that could enable attackers to execute pipelines on arbitrary branches, posing a significant security threat to impacted instances.
The critical vulnerability identified as CVE:2024-9164 impacts all versions of GitLab Enterprise Edition from 12.5 onward. This flaw enables malicious actors to execute pipeline across any branch, posing a significant risk of unauthenticated access to sensitive data and system. With a CVSS score of 9.6, this issue is recognized as highly severe.
Palo Alto Networks Confirms critical RCE zero-day actively exploited
CISA, FBI Warns
Hacker compromised multiple teleco network at US
(CVE-2024-52301)
Laravel Flaw Unveils Millions of Web Applications to Attack
Bitdefender releases free decryptor for ShrinkLocker ransomware
Fortinet releases updates for Various Products
Microsoft November Patch Tuesday: 4 Zero-Days & 89 flaws
CISA Warns of 3 Critical Vulnerabilities in Industrial Control Systems
Cyberattack Disrupts Israel’s Gas and Payment Systems
Russia blocks thousands websites using Cloudflare’s privacy service
Hacker to sale Indian Gov.t email credentials
Other significant vulnerabilities addressed in this update include:
CVE-2024-8970: Let attackers pretend to be other users in certain situations, which could result in unauthorized actions and data leaks.
CVE-2024-8977: A security flaw that allows attacker to access internal resources and services through the Analytins Dashboard.
CVE-2024-9631: Checking code changes in merge requests with conflicts can be slow, causing a denial of services (DoS) condition.
CVE-2024-6530: A vulnerability that lets attackers run harmful scripts and steal user information.
GitLab has fixed vulnerabilities in versions 17.4.2, 17.3.5 and 17.2.9 for both Community and Enterprise Editions. Users should upgrade to one of these versions right away.
Related topics
Lumma C2 malware attack Bangladeshi several websites
Bangladeshi 32.4% government websites face cyber attack: NAS report
