InfoSecBulletin Cybersecurity for mankind
GitLab released a security update today to fix six vulnerabilities in its software. Although none of the flaws are critical, there is one high-severity cross-site scripting bug that could seriously affect users who don’t update quickly.
The update, which applies to GitLab Community Edition (CE) and Enterprise Edition (EE), includes the following versions:
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
17.2.1
17.1.3
17.0.5
The main fix is for an XSS vulnerability in the “Maven Dependency Proxy” feature. This vulnerability could be used by attackers to inject harmful scripts into web pages, which could lead to session hijacking, data theft, or other malicious activities.
Here’s a quick summary of the vulnerabilities addressed:
High: 1 (XSS in Maven Dependency Proxy)
Medium: 3 (including CVE-2024-5067 and CVE-2024-7057)
Low: 2
At the time of the advisory, the XSS vulnerability didn’t have a CVE number yet, but it was rated 7.7 on the CVSSv3.1 scoring system, showing a big risk. GitLab’s internal security team found the flaw and credited for it.
GitLab suggests that all users update to one of the patched versions as soon as possible.
