#Ransomwhere software update

CVSS 9.8 – Multiple CVEs: Hitachi Energy's RTU500 series modules contain bugs in a wide variety of firmware versions that could be combined to cause denial of service or completely crash affected devices.CVSS 9.8 – Multiple CVEs: Version 1.0 of Moxa's MXsecurity software contains hard-coded credentials that could be exploited to give an attacker RCE capabilities.

CVSS 10.0 – CVE-2023-1424: Several models of Mitsubishi MELSEC CPU modules contain a buffer overflow vulnerability that an attacker could use to execute malicious code on target machines.

Outside of the GitLab report, a quartet of critical ICS vulnerabilities were reported by CISA this week:

#Ransomwhere software update

GitLab's own security advisory for the flaw contained minimal information, but did include a warning to update to version 16.0.1 as soon as possible. Those vulnerable could find that an unauthenticated attacker could read arbitrary files on a GitLab server when attachments are nested at least five groups down on public projects.

Identified as CVE-2023-2825, the issue exists in community and enterprise editions of GitLab running version 16.0.0, while prior versions of the platform aren't affected. GitLab issues emergency patch for CVSS 10.0 vulnerabilityĪnyone hosting code on GitLab should take this week's list of critical vulnerabilities seriously – the code repository released an emergency patch for a rather serious path traversal flaw this week.