Tag: gitlab
-
‘Dangerous’ vulnerability in GitLab Ultimate Enterprise Edition
Tags: access, ai, attack, authentication, best-practice, ceo, communications, control, cve, cvss, data, flaw, github, gitlab, incident response, injection, malicious, mfa, password, risk, service, vulnerabilityCVE-2025-2254, a cross-site scripting issue, which, under certain conditions, could allow an attacker to act like a legitimate user by injecting a malicious script into the snippet viewer.All GitLab CE/EE versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 are impacted;CVE-2025-0673, a vulnerability that can cause a denial of service by triggering…
-
Ungepatchte Lücken ermöglichen Übernahme von GitLab-Konten
Tags: access, authentication, best-practice, bug, ceo, ciso, cve, cvss, cyberattack, dos, github, gitlab, incident response, injection, jobs, mfa, password, risk, sans, service, software, update, vulnerabilityExperten warnen vor einem neuen Bug in GitLab.Eine neue Sicherheitslücke in der Ultimate Enterprise Edition von GitLab ist laut einem Experten ‘gefährlich” und muss schnell gepatcht werden.Die Schwachstelle mit der Bezeichnung CVE-2025-5121 ist eine von zehn, die GitLab am Mittwoch bei der Veröffentlichung von Bugfixes und Sicherheits-Updates für selbstverwaltete Installationen beschrieben hat.’Wir empfehlen dringend, alle…
-
Unpatched holes could allow takeover of GitLab accounts
Tags: access, attack, authentication, best-practice, ceo, communications, control, cve, cvss, data, github, gitlab, incident response, malicious, mfa, password, risk, service, vulnerabilityCVE-2025-2254, a cross-site scripting issue, which, under certain conditions, could allow an attacker to act like a legitimate user by injecting a malicious script into the snippet viewer.All GitLab CE/EE versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 are impacted;CVE-2025-0673, a vulnerability that can cause a denial of service by triggering…
-
Multiple GitLab Vulnerabilities Expose Users to Complete Account Takeover Risks
GitLab, the widely used DevSecOps platform, has released urgent security updates addressing multiple high-severity vulnerabilities that could allow attackers to take over user accounts, inject malicious code, and disrupt services. The new versions”, 18.0.2, 17.11.4, and 17.10.8 for both Community Edition (CE) and Enterprise Edition (EE)”, contain critical fixes, and administrators are strongly advised to…
-
Cloud assets have 115 vulnerabilities on average, some several years old
Tags: access, ai, api, attack, cloud, credentials, data, data-breach, github, gitlab, iam, infrastructure, risk, service, strategy, threat, vulnerabilityIsolated risks lead to bigger issues: Orca also warns that half of organizations have assets exposing attack paths that can lead to sensitive data exposure, as well as 23% with paths that lead to broad permission access and compromised hosts. Attack paths are the combination of risks that appear isolated but can be combined to…
-
How GitLab is tapping AI in DevSecOps
GitLab CISO Josh Lemos explains how the company is weaving AI, through its Duo tool, into the entire software development lifecycle to enhance efficiency and automate incident response First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366625222/How-GitLab-is-tapping-AI-in-DevSecOps
-
When AI Turns Against Us FireTail Blog
Jun 04, 2025 – Lina Romero – Artificial Intelligence is the biggest development in tech of the 21st century. But although AI is continuing to develop at a breakneck pace, many of us still don’t understand all the risks and implications for cybersecurity. And this issue is only growing more complicated and critical. Now more…
-
Patched GitLab Duo Flaws Risked Code Leak, Malicious Content
Prompt Injection, HTML Output Rendering Could Be Used for Exploit. Hackers can exploit vulnerabilities in a generative artificial intelligence assistant integrated across GitLab’s DevSecOps platform to manipulate the model’s output, exfiltrate source code and potentially deliver malicious content through the platform’s user interface. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/patched-gitlab-duo-flaws-risked-code-leak-malicious-content-a-28499
-
GitLab Vulnerability ‘Highlights the Double-Edged Nature of AI Assistants’
A remote prompt injection flaw in GitLab Duo allowed attackers to steal private source code and inject malicious HTML. GitLab has since patched the issue. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-gitlab-duo-vulnerability-hidden-prompts/
-
GitLab ‘Vulnerability Highlights the Double-Edged Nature of AI Assistants’
A remote prompt injection flaw in GitLab Duo allowed attackers to steal private source code and inject malicious HTML. GitLab has since patched the issue. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-gitlab-duo-vulnerability-hidden-prompts/
-
Researchers cause GitLab AI developer assistant to turn safe code malicious
AI assistants can’t be trusted to produce safe code. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/05/researchers-cause-gitlab-ai-developer-assistant-to-turn-safe-code-malicious/
-
GitLab Duo Vulnerability Exploited to Inject Malicious Links and Steal Source Code
A security vulnerability was recently discovered in GitLab Duo, the AI-powered coding assistant integrated into GitLab and based on Anthropic’s Claude models. Security researchers from Legit Security revealed that attackers could exploit an indirect prompt injection flaw to exfiltrate private source code, manipulate AI-generated code suggestions, and even leak confidential zero-day vulnerabilities”, all through seemingly…
-
GitLab Duo Vulnerability Enabled Attackers to Hijack AI Responses with Hidden Prompts
Cybersecurity researchers have discovered an indirect prompt injection flaw in GitLab’s artificial intelligence (AI) assistant Duo that could have allowed attackers to steal source code and inject untrusted HTML into its responses, which could then be used to direct victims to malicious websites.GitLab Duo is an artificial intelligence (AI)-powered coding assistant that enables users to…
-
GitLab’s AI Assistant Opened Devs to Code Theft
Even after a fix was issued, lingering prompt injection risks in GitLab’s AI assistant might allow attackers to indirectly deliver developers malware, dirty links, and more. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/gitlab-ai-assistant-opened-devs-to-code-theft
-
GitHub’s AI Assistant Opened Devs to Code Theft
Even after a fix was issued, lingering prompt injection risks in GitLab’s AI assistant might allow attackers to indirectly deliver developers malware, dirty links, and more. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/github-ai-assistant-opened-devs-to-code-theft
-
Several GitLab Vulnerabilities Enable Attackers to Launch DoS Attacks
GitLab has issued critical security patches addressing 11 vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) platforms, with three high-risk flaws enabling denial-of-service (DoS) attacks dominating the threat landscape. The coordinated release of versions 18.0.1, 17.11.3, and 17.10.7 comes as the DevOps platform confronts multiple attack vectors that could destabilize systems through resource…
-
GitLab 18 rolls out with duo AI features
First seen on scworld.com Jump to article: www.scworld.com/brief/gitlab-18-rolls-out-with-duo-ai-features
-
GitLab Releases Critical Patch for XSS, DoS, and Account Takeover Bugs
GitLab, a leading DevOps platform, has released a critical security patch impacting both its Community (CE) and Enterprise (EE) editions, urging all self-managed users to update immediately. The new versions”, 17.11.1, 17.10.5, and 17.9.7″, address several high and medium-severity vulnerabilities, including cross-site scripting (XSS), denial of service (DoS), and account takeover threats. GitLab emphasizes the…
-
Availity eyes GitLab Duo with Amazon Q for code refactoring
The healthcare network’s release engineering team is testing the new AI agent pairing to help with code consolidation, modernization and risk mitigation. First seen on techtarget.com Jump to article: www.techtarget.com/searchitoperations/news/366622842/Availity-eyes-GitLab-Duo-with-Amazon-Q-for-code-refactoring
-
Ransomware-Attacke auf Europcar
Tags: access, android, backup, cloud, computer, cyberattack, dark-web, gitlab, hacker, infrastructure, mail, ransomwareEuropcar hat einen Cyberangriff mit Datendiebstahl erlitten.Im Darknet sind kürzlich Hinweise auf einen Cyberangriff bei Europcar aufgetaucht, bei dem Kundendaten und andere vertrauliche Informationen entwendet wurden. Wie aus einem Bericht von Bleeping Computer hervorgeht, ist der Angreifer in die Gitlab-Repositories des Fahrzeugvermieters eingedrungen und hat Daten von 200.000 Kunden und den Quellcode für Android- und…
-
Europcar GitLab Breach Exposes Customer Data
First seen on scworld.com Jump to article: www.scworld.com/brief/europcar-gitlab-breach-exposes-customer-data
-
Up to 200K purportedly impacted by Europcar GitLab breach
First seen on scworld.com Jump to article: www.scworld.com/brief/up-to-200k-purportedly-impacted-by-europcar-gitlab-breach
-
Datenleck: Kundendaten und Quellcode von Europcar abgeflossen
Ein Hacker hat wohl erfolgreich Gitlab-Repos von Europcar kompromittiert und dadurch Kundendaten und andere vertrauliche Informationen erbeutet. First seen on golem.de Jump to article: www.golem.de/news/datenleck-kundendaten-und-quellcode-von-europcar-abgeflossen-2504-195077.html
-
Hack The box >>Ghost<< Challenge Cracked A Detailed Technical Exploit
Cybersecurity researcher >>0xdf>Ghost
-
Europcar GitLab breach exposes data of up to 200,000 customers
A hacker breached the GitLab repositories of multinational car-rental company Europcar Mobility Group and stole source code for Android and iOS applications, as well as some personal information belonging to up to 200,000 users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/europcar-gitlab-breach-exposes-data-of-up-to-200-000-customers/
-
Why So Many Employee Phishing Training Initiatives Fall Short
During the work-from-home boom of 2020, GitLab, a company that largely employs tech-savvy individuals, decided to test its security by sending fake phishing messages to its WFH workers. About one out of every five tested employees fell for it, and… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/why-so-many-employee-phishing-training-initiatives-fall-short/
-
GitLab fixes critical SSO bypass vulnerabilities in update
First seen on scworld.com Jump to article: www.scworld.com/news/gitlab-fixes-critical-sso-bypass-vulnerabilities-in-update