GitLab Releases Patch (CVE-2025-0314) for XSS Exploit

GitLab has released update for high severity cross-site scripting (XSS) flaw. Versions 17.8.1, 17.7.3, and 17.6.4 for both Community Edition (CE) and Enterprise Edition (EE) have been released to address these issues.

The CVE-2025-0314 allows attackers to inject malicious scripts into GitLab instances via “improper rendering of certain file types” leading to attackers hijacking user sessions, stealing sensitive data, or taking control of affected systems.

• Alert

Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws

By infosecbulletin / Thursday , October 1 2026

Hackers to exploit a flaw in Zimbra mail servers that are connected to the Internet. They send special emails that...

Read More

• Alert

Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws

By infosecbulletin / Wednesday , September 30 2026

Google has said that hackers are using two serious Citrix NetScaler security holes to get root access, set up hidden...

Read More

• Alert

CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks

By infosecbulletin / Wednesday , September 30 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is alerting people about a major flaw in MikroTik RouterOS. This could...

Read More

• Alert
• Cyber Attack

Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People

By infosecbulletin / Tuesday , September 29 2026

Apple has launched iOS 26.7.1 and iPadOS 26.7.1 to fix a serious zero-day flaw that it believes might have been...

Read More

• Cyber Attack

JadePuffer Agentic AI targets and destroys Azure’s cloud resources

By infosecbulletin / Tuesday , September 29 2026

The JadePuffer ransomware group is attacking Azure users with agent-based attacks that gather information, steal passwords, and damage key components. The...

Read More

• Event
• Feature

“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”

By infosecbulletin / Tuesday , September 29 2026

The 5th Edition of InfoSecCon-2026, a premier cybersecurity-focused event, has been successfully completed with the participation of cybersecurity professionals, technology...

Read More

• Alert

Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation

By infosecbulletin / Saturday , September 19 2026

Microsoft has fixed a serious security flaw in Azure AI Foundry that could let bad actors gain privilege escalation. The...

Read More

• Hot Topic

AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage

By infosecbulletin / Friday , September 18 2026

Amazon Web Services cannot restore access to its cloud-computing facility in Bahrain and ‌one of three data-hosting zones in the...

Read More

• Alert

Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw

By infosecbulletin / Friday , September 18 2026

A threat actor is allegedly offering a private remote code execution exploit for Fortinet FortiGate SSL VPN appliances, claiming that...

Read More

• Hot Topic

Anthropic prepares “Claude Money” to analyze bank account and financial data

By infosecbulletin / Thursday , September 17 2026

Anthropic is making a new Claude feature called “Money.” It's a separate tab in the mobile app. The new interface...

Read More

GitLab said, “An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.”

This vulnerability has a CVSS score of 8.7, indicating a high severity threat.

Other vulnerabilities addressed in this release include:

CVE-2024-11931: A medium severity flaw (CVSS score 6.4) that could allow developers to “exfiltrate protected CI/CD variables via CI lint.”

CVE-2024-6324: A medium severity denial-of-service (DoS) vulnerability (CVSS score 4.3) related to “cyclic reference of epics.”

GitLab strongly urges all users to update their installations immediately. “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.”

Cisco Fixes Meeting Management Allowing Privilege Escalation