Our news and updates

In GitLab CE/EE versions 17.7 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2024-12303 was detected. This vulnerability allows authenticated users with specific roles and permissions to delete issues, including confidential ones, by inviting users with a specific role. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.6, 18.1.4, 18.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12303.

In GitLab CE/EE versions 15.6 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2024-10219 was detected. This vulnerability allows authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints. To address this issue, users should upgrade GitLab CE/EE to versions 18.0.6, 18.1.4, 18.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10219.

In @backstage/plugin-scaffolder-backend versions prior to 2.1.1 a medium severity vulnerability CVE-2025-55285 was detected. Duplicate logging of input values in the fetch:template action could expose template secrets (e.g., ${{ secrets.x }}) in logs, leading to unintended disclosure, though there is no impact if such secrets are not passed through to fetch:template. To address this issue, users should upgrade scaffolder-backend plugin to versions 2.1.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55285.

In Liferay Portal versions 7.3.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 a low severity vulnerability CVE-2025-3639 was detected. This vulnerability allows unauthenticated attackers with valid credentials to bypass multi-factor authentication (MFA) by changing the HTTP method from POST to GET during login. Currently, there is no fix version for this issue. For more details, visit CVE-2025-3639.

In Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 a medium severity vulnerability CVE-2025-43731 was detected. This vulnerability allows remote authenticated attackers to inject JavaScript in message board threads and categories, leading to reflected cross-site scripting (XSS). To address this issue, users should upgrade Liferay Portal fixed on master branch and Liferay DXP 2025.Q2.0, 2025.Q1.9 or 2024.Q1.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43731.

In GitLab CE/EE versions from 11.6 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2025-2614 was detected. This vulnerability allows authenticated users to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed, due to lack of proper throttling or resource limits. To address this issue, users should upgrade GitLab CE/EE to versions 18.2.2, 18.1.4 or 18.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2614.

In GitLab CE/EE versions from 8.14 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 a medium severity vulnerability CVE-2025-1477 was detected. This vulnerability allows unauthenticated users to cause a denial of service condition by sending specially crafted payloads to specific integration API endpoints, due to lack of proper resource limits and throttling. To address this issue, users should upgrade GitLab CE/EE to versions 18.2.2, 18.1.4 or 18.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-1477.

In Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier a high severity vulnerability CVE-2025-49558 was detected. This vulnerability allows attackers to bypass security features by exploiting a Time-of-check Time-of-use (TOCTOU) Race Condition, enabling unauthorized write access. To address this issue, users should upgrade Magento to versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 or 2.4.4-p15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49558.

In Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier a high severity vulnerability CVE-2025-49554 was detected. This vulnerability allows attackers to cause a denial-of-service (DoS) condition by providing specially crafted input, leading the application to crash or become unresponsive. To address this issue, users should upgrade Adobe Commerce to versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 or 2.4.4-p15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49554.