Overview
GitLab have discovered a vulnerability affecting all versions of the product prior to 16.7.0. The vulnerability, CVE-2023-7028, sends password reset emails to incorrect, unverified accounts. GitLab advise all users of their products to update to the latest versions, as these contain important security fixes and patches.
CISCO have released a security advisory to address three vulnerabilities, all with base score of 7.5, in four IP Phone product lines. CVE-2024-20376 affects the web-based management interface, and exploitation could allow remote attackers to force the device to reload by sending a crafted request, resulting in a DoS. CVE-2024-20378 also affects the web-based management interface, and could allow remote, unauthenticated attackers to connect to the device and retrieve sensitive information. CVE-2024-20357 affects the XML Service, with successful exploitation resulting in remote, unauthenticated attackers initiating calls or playing sounds on affected devices.
Microsoft have released a vulnerability update addressing CVE-2024-29988, which could allow an attacker to send targeted users a specifically crafted file that is designed to exploit the remote code execution vulnerability. Successful exploitation requires the attacker to convince a user to launch a malicious file using a launcher application that requests that no user interface is shown.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
GitLab – Security Bulletin
CISCO – Security Advisory
Microsoft – CVE-2024-29988
If you have any concerns, or have been affected by a cyber-related issue, report it to us by submitting a Cyber Concerns Online Reporting Form.