InfoSecBulletin Cybersecurity for mankind
GitLab has released a security advisory, urging all self-managed installations to upgrade to versions 17.9.1, 17.8.4, or 17.7.6 due to critical vulnerabilities, including serious Cross-Site Scripting (XSS) issues that may compromise user data.
The Kubernetes proxy vulnerability (CVE-2025-0475) has a CVSS score of 8.7, signifying a high risk. It affects all versions prior to the patched releases starting from 15.10. GitLab notes that this flaw might enable unintended content rendering, leading to XSS attacks. Attackers could exploit this to inject malicious code into a user’s browser, risking credential theft and other malicious activities.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
A high-severity XSS vulnerability (CVE-2025-0555) with a CVSS score of 7.7 impacts the Maven Dependency Proxy in GitLab-EE. It affects versions 16.6 and earlier, allowing attackers to bypass security controls and execute arbitrary scripts in a user’s browser under certain conditions.
In addition to the XSS flaws, GitLab has addressed several other security issues:
CVE-2024-8186: A medium-severity vulnerability (CVSS 5.4) permits HTML injection in child item searches, potentially leading to XSS.
CVE-2024-10925: A medium-severity vulnerability (CVSS 5.3) allows guest users to access security policy YAML files.
A medium-severity vulnerability (CVSS 4.3) allows users with limited access to read sensitive project analytics in private projects. (CVE-2025-0307)
Administrators should update their GitLab instances to the latest compatible version.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” GitLab emphasized.
Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts
