Vulnerabilitycritical
GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-22277 | VMware Cloud Director Availability contains an HTML injection vulnerability | 5.4 | <1% | ||
| CVE-2024-22280 | VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product | 8.1 | <1% | ||
CVE-2024-6385+1 related CVE | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… | 9.8 group max | 6% | ||
| CVE-2024-5655 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… | 8.8 | 7% | ||
| CVE-2024-6235 | Sensitive information disclosure in NetScaler Console | 9.4 | 21% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jul 11, 2024 Software Security / Vulnerability GitLab has shipped another round of updates to close out security flaws in its software development platform, including a critical bug that allows an attacker to run pipeline jobs as an arbitrary user. Tracked as CVE-2024-6385, the vulnerability carries a CVSS score of 9. 6 out of a maximum of 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.