* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Friday, July 11, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Immersive sports and entertainment venue Cosm set to build its 5th location in Cleveland – WKYC

    Cosm Reveals Exciting Vision for Its 5th Immersive Sports and Entertainment Venue in Cleveland

    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    SMPTE Opens Early Bird Registration for Media Technology Summit – TVTechnology

    SMPTE Launches Early Bird Registration for Exciting Media Technology Summit

    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Immersive sports and entertainment venue Cosm set to build its 5th location in Cleveland – WKYC

    Cosm Reveals Exciting Vision for Its 5th Immersive Sports and Entertainment Venue in Cleveland

    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

    SMPTE Opens Early Bird Registration for Media Technology Summit – TVTechnology

    SMPTE Launches Early Bird Registration for Exciting Media Technology Summit

    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

GitLab: Critical bug lets attackers run pipelines as other users

July 11, 2024
in Technology
GitLab: Critical bug lets attackers run pipelines as other users
Share on FacebookShare on Twitter

GitLab

GitLab warned today that a critical vulnerability in its product’s GitLab Community and Enterprise editions allows attackers to run pipeline jobs as any other user.

The GitLab DevSecOps platform has over 30 million registered users and is used by over 50% of Fortune 100 companies, including T-Mobile, Goldman Sachs, Airbus, Lockheed Martin, Nvidia, and UBS.

The flaw patched in today’s security update is tracked as CVE-2024-6385, and it received a CVSS base score severity rating of 9.6 out of 10.

It impacts all GitLab CE/EE versions from 15.8 to 16.11.6, 17.0 to 17.0.4, and 17.1 to 17.1.2. Under certain circumstances that GitLab has yet to disclose, attackers can exploit it to trigger a new pipeline as an arbitrary user.

GitLab pipelines are a Continuous Integration/Continuous Deployment (CI/CD) system feature that lets users automatically run processes and tasks in parallel or sequentially to build, test, or deploy code changes.

The company released GitLab Community and Enterprise versions 17.1.2, 17.0.4, and 16.11.6 to address this critical security flaw and advised all admins to upgrade all installations immediately.

“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” it warned. “GitLab.com and GitLab Dedicated are already running the patched version.”

Account takeover flaw actively exploited in attacks

GitLab patched an almost identical vulnerability (tracked as CVE-2024-5655) in late June, which could also be exploited to run pipelines as other users.

One month earlier, it fixed a high-severity vulnerability (CVE-2024-4835) that enables unauthenticated threat actors to take over accounts in cross-site scripting (XSS) attacks.

As CISA warned in May, threat actors are also actively exploiting another zero-click GitLab vulnerability (CVE-2023-7028) patched in January. This vulnerability allows unauthenticated attackers to hijack accounts via password resets.

While Shadowserver found over 5,300 vulnerable GitLab instances exposed online in January, less than half (1,795) are still reachable today.

Attackers target GitLab because it hosts various types of sensitive corporate data, including API keys and proprietary code, leading to significant security impact following a breach.

This includes supply chain attacks if the threat actors insert malicious code in CI/CD (Continuous Integration/Continuous Deployment) environments, compromising the breached organization’s repositories.

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : BleepingComputer – https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-bug-that-lets-attackers-run-pipelines-as-an-arbitrary-user/

Tags: criticalGitLabtechnology
Previous Post

ViperSoftX malware covertly runs PowerShell using AutoIT scripting

Next Post

Huione Guarantee exposed as a $11 billion marketplace for cybercrime

2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

July 10, 2025
Bulldogs Land Eight on Athlon Sports Preseason All-CUSA Team – LA Tech Athletics

Bulldogs Shine with Eight Players Named to Preseason All-CUSA Team

July 10, 2025
ECOLOGY ACTION CENTER – Ad from 2025-07-06 – The Pantagraph

See How the Ecology Action Center is Revolutionizing Environmental Change

July 10, 2025
Climate Disasters Like Texas Floods Moving Faster Than Science Can Keep Up – The Energy Mix

Climate Disasters Like Texas Floods Moving Faster Than Science Can Keep Up – The Energy Mix

July 10, 2025
The Best Science Fiction Novels to Read Right Now – The New York Times

Top Science Fiction Novels You Can’t Miss Right Now

July 10, 2025
This is the Summer of CoAqua. CoAqua Isn’t Just a Coconut Water — It’s a Lifestyle Brand That Disrupted the Hydration Game with Bold Flavors, Design-Forward Packaging, and a Good Mission – Nosh.com

This is the Summer of CoAqua. CoAqua Isn’t Just a Coconut Water — It’s a Lifestyle Brand That Disrupted the Hydration Game with Bold Flavors, Design-Forward Packaging, and a Good Mission – Nosh.com

July 10, 2025
Manchester United hope new stadium will host 2035 World Cup final, aim to finish project in 5 to 6 years – The New York Times

Manchester United hope new stadium will host 2035 World Cup final, aim to finish project in 5 to 6 years – The New York Times

July 10, 2025
Alaska is America’s worst state for business in 2025 as falling oil prices sink economy – CNBC

Alaska Braces for Toughest Business Climate in 2025 Amid Plummeting Oil Prices

July 10, 2025
Access Health CT expects significant drop in insurance enrollees as aid ends, Medicaid cut – CT Insider

Access Health CT Faces Steep Drop in Insurance Enrollments After Aid and Medicaid Reductions

July 10, 2025
The nation’s cartoonists on the week in politics – Politico

Top Cartoonists Bring This Week’s Political Drama to Life

July 10, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (714)
  • Economy (737)
  • Entertainment (21,626)
  • General (15,816)
  • Health (9,774)
  • Lifestyle (744)
  • News (22,149)
  • People (739)
  • Politics (747)
  • Science (15,955)
  • Sports (21,236)
  • Technology (15,723)
  • World (720)

Recent News

2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

2025 WE Local Prague Recap: Inspiring Women in Engineering and Technology – Society of Women Engineers

July 10, 2025
Bulldogs Land Eight on Athlon Sports Preseason All-CUSA Team – LA Tech Athletics

Bulldogs Shine with Eight Players Named to Preseason All-CUSA Team

July 10, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version