InfoSecBulletin Cybersecurity for mankind
GitLab released security updates on Wednesday to fix 17 vulnerabilities, including a critical issue that lets attackers run pipeline jobs as any user. CVE-2024-6678 is a critical vulnerability with a CVSS score of 9.9 out of 10.0
“An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances,” the company said in an alert.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
The vulnerability, along with three high-severity, 11 medium-severity, and two low-severity bugs, has been fixed in GitLab CE and EE versions 17.3.2, 17.2.5, and 17.1.7.
CVE-2024-6678 is the fourth serious flaw GitLab has fixed in the past year, joining CVE-2023-5009, CVE-2024-5655, and CVE-2024-6385, all with a CVSS score of 9.6.
Users should apply the patches quickly to prevent potential threats, even though there is currently no evidence of active exploitation of the flaws.
In May, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that a critical GitLab vulnerability (CVE-2023-7028, CVSS score: 10.0) was being actively exploited.
