Help Net Security

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have two-factor authentication ...
Ars Technica

Maximum-severity GitLab flaw allowing account hijacking under active exploitation

A maximum severity vulnerability that allows hackers to hijack GitLab accounts with no user interaction required is now under active exploitation, federal government ...
Dark Reading

Critical GitLab Bug Under Exploit Enables Account Takeover, CISA Warns

A critical security vulnerability in GitLab is under active attack, according to CISA. It allows bad actors to send password reset emails for any account to an email address of their choice, thus ...
InfoWorldOpinion

GitLab issue email’s only security is obscurity

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project ...
Seeking Alpha

Over 5,300 GitLab servers vulnerable to zero-click account takeover flaw - Bleeping Computer

More than 5,300 internet-exposed GitLab (NASDAQ:GTLB) servers are at risk to CVE-2023-7028, a zero-click account takeover flaw the company had warned about earlier, technology news site Bleeping ...
BleepingComputer

GitLab warns of critical zero-click account hijacking vulnerability

GitLab has released security updates for both the Community and Enterprise Edition to address two critical vulnerabilities, one of them allowing account hijacking with no user interaction. The vendor ...
BleepingComputer

Critical GitLab vulnerability lets attackers take over accounts

GitLab has addressed a critical severity vulnerability that could allow remote attackers to take over user accounts using hardcoded passwords. The bug (discovered internally and tracked as ...