InfoSecBulletin Cybersecurity for mankind
GitLab, a premier platform for DevOps and continuous integration/continuous delivery has rolled out essential security updates in versions 17.4.2, 17.3.5 and 17.2.9 for both community Edition (CE) and enterprises edition (EE). These updates tackles several important vulnerabilities, notably a critical severity flaw (CVE: 2024-9164) that could enable attackers to execute pipelines on arbitrary branches, posing a significant security threat to impacted instances.
The critical vulnerability identified as CVE:2024-9164 impacts all versions of GitLab Enterprise Edition from 12.5 onward. This flaw enables malicious actors to execute pipeline across any branch, posing a significant risk of unauthenticated access to sensitive data and system. With a CVSS score of 9.6, this issue is recognized as highly severe.
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Other significant vulnerabilities addressed in this update include:
CVE-2024-8970: Let attackers pretend to be other users in certain situations, which could result in unauthorized actions and data leaks.
CVE-2024-8977: A security flaw that allows attacker to access internal resources and services through the Analytins Dashboard.
CVE-2024-9631: Checking code changes in merge requests with conflicts can be slow, causing a denial of services (DoS) condition.
CVE-2024-6530: A vulnerability that lets attackers run harmful scripts and steal user information.
GitLab has fixed vulnerabilities in versions 17.4.2, 17.3.5 and 17.2.9 for both Community and Enterprise Editions. Users should upgrade to one of these versions right away.
Related topics
Lumma C2 malware attack Bangladeshi several websites
Bangladeshi 32.4% government websites face cyber attack: NAS report
