Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation

External Penetration Testing

Secure Internet-facing IT assets.

Internal Penetration Testing

Secure internal networks and servers.

Web Application Penetration Testing

Secure mission-critical Web Apps & APIs.

Medical Device Penetration Testing

Secure smart medical equipment & data.

Cloud Security Services

Secure cloud-hosted assets & environments.

SCADA Cybersecurity Assessment

Secure SCADA / ICS systems & networks.

Cyber Maturity Assessment

Assess and prioritize your cybersecurity.

Red Team Security Services

Protect against sophisticated cyberattacks.

Consulting & Professional Services

Get advice and support from certified experts.

Compliance Services

Meet the requirements of various standards.

View All Vumetric Services →

SOLUTIONS BY STANDARD

SOLUTIONS BY INDUSTRY

SOLUTIONS BY CHALLENGE

Secure your network infrastructure

Protect your network from security breaches.

Secure your applications

Secure your missions-critical applications (Web, Mobile ,etc.).

Secure your cloud infrastructure

Ensure the security of your cloud environments.

Prevent ransomware attacks

Protect your business from ransomware attacks.

Contact a Cybersecurity Specialist →

About Vumetric

Learn more about Vumetric and discover why hundreds of organizations trust our experts.

Partnership Program

Unlock new business opportunites by reselling top-of-the-line cybersecurity services.

Certifications

Discover our team's cybersecurity and penetration testing certifications.

PTaaS Platform

Discover the modern way to launch and manage your penetration testing projects.

Methodologies

Discover our cybersecurity testing methodologies and standards.

Careers

Explore new career opportunities and join our team of passionate experts.

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

Critical, CVE, Gitlab, Patch
January 12, 2024

A critical vulnerability in GitLab CE/EE can be easily exploited by attackers to reset GitLab user account passwords.

Users who have two-factor authentication enabled on their account are safe from account takeover.

“We have not detected any abuse of this vulnerability on platforms managed by GitLab, including GitLab.com and GitLab Dedicated instances. Self-managed customers can review their logs to check for possible attempts to exploit this vulnerability,” GitLab security engineer Greg Myers noted, and outlined what to look for.

CVE-2023-7028 was reported through the company’s bug bounty program and has been fixed in GitLab CE and EE versions 16.7.2, 16.6.4, 16.5.6.

GitLab advises admins of self-managed GitLab instances to upgrade to a patched version immediately, and to enable 2FA for all GitLab accounts.

CVE-2023-5356, a critical bug caused by incorrect authorization checks, which may allow a user to abuse Slack/Mattermost integrations to execute slash commands as another user.

Share this article on social media: