GitLab CVSS 10.0 file read, Fortinet hardcoded creds, and an Edge use-after-free

MoguBlog's comment deletion endpoint checks ownership using values the client sends in the request body instead of checking who's actually logged in. An attacker can grab comment and author IDs from public listing endpoints, then delete any comment (and its replies) on the site without authenticating as the owner.

Affected estate

Anyone self-hosting MoguBlog 6.2 or earlier

How to check

Check your MoguBlog version in the admin panel or in the project's package/config files.

Included because

unauthenticated; authorization bypass; data deletion without credentials

Action

Update MoguBlog to a version that fixes the authorization bypass. If no patch exists yet, restrict access to the comment deletion API endpoint at the reverse proxy or WAF level.

Why it matters

Any unauthenticated visitor can wipe all comments from your blog, causing data loss and disrupting community engagement.

A use-after-free bug in the Chromium engine powering Microsoft Edge lets an authenticated attacker run arbitrary code over the network. The attacker needs to lure a user to a malicious page or compromised site, but once they do, they can execute code in the context of the browser process. CVSS 8.5, not yet exploited in the wild.

Affected estate

Anyone running Microsoft Edge on Windows, macOS, or Linux

How to check

Open edge://settings/help in Edge, or query your endpoint management tool for Edge browser versions across the fleet.

Included because

network-exploitable; code execution; browser is a common attack surface; CVSS 8.5

Action

Push the latest Edge update through WSUS, Intune, or your browser management platform.

Why it matters

Use-after-free bugs in browser engines are a favorite target for attackers building exploit chains. A single malicious link could lead to code execution on a workstation.

Source

Microsoft advisory

A race condition in MongoDB Server's document value layer lets concurrent threads stomp on the same memory without synchronization. Any authenticated user with normal read-write privileges can trigger this through the standard client protocol, crashing the server or potentially corrupting process memory with attacker-influenced content. This is a denial-of-service risk at minimum, with a real chance of worse outcomes.

Affected estate

Anyone running self-managed MongoDB Server instances where users have read-write database access

How to check

Run 'mongod --version' or 'db.version()' in the mongo shell. Cross-reference the result with the MongoDB security advisory for this CVE.

Included because

authenticated but low-privilege; server crash and memory corruption; common database product; CVSS 7.5

Action

Upgrade to the patched MongoDB Server version listed in the advisory. As a short-term measure, audit database users and revoke unnecessary read-write privileges.

Why it matters

Any authenticated database user can crash your MongoDB instance or corrupt its memory, putting availability and data integrity at risk.

Source

MongoDB advisory

This is a CVSS 10.0 and it earns it. An unauthenticated attacker can read arbitrary files from your GitLab server by abusing a path traversal bug combined with missing authentication in the repository commits API. That means config files, secrets, private keys, source code: anything the GitLab process can read on disk is fair game. No login required.

Affected estate

Anyone running self-managed GitLab CE or EE versions 18.7 through 19.1.7, 19.2 through 19.2.5, or 19.3 through 19.3.1

How to check

Run 'gitlab-rake gitlab:env:info' or check the version in Admin Area > Overview. You can also query the /api/v4/version endpoint.

Included because

unauthenticated; internet-facing; arbitrary file read; CVSS 10.0; widely deployed product

Action

Upgrade to GitLab 19.1.8, 19.2.6, or 19.3.2. Then rotate all secrets on the server: Rails secrets, SSH host keys, CI/CD variables, runner tokens, and any credentials stored in config files.

Why it matters

An unauthenticated attacker can read any file on your GitLab server. That includes database credentials, secrets files, and private source code. This is full information disclosure with zero authentication.

Source

GitLab advisory