Design/Logic Flaw

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...

CVE-2020-5886

CVE-2020-5886 affects BIG-IP products with connection mirroring in HA setups. Affected versions include 12.1.0–12.1.5, 13.1.0–13.1.3, 14.1.0–14.1.2, and 15.0.0–15.1.0.1. The vulnerability enables on-path attackers to read or modify Diffie-Hellman parameters by transferring sensitive cryptographic...

CVE-2020-5885

CVE-2020-5885 affects F5 BIG-IP in HA connection mirroring setups. A control plane issue allows on-path attackers to read/modify keys used for EXPORT-based cipher suites by transferring sensitive cryptographic objects over an insecure channel. Affected versions and fixes per vendor advisories: BI...

CVE-2020-5885

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...

CVE-2020-5884

CVE-2020-5884 affects BIG-IP high availability (HA) state/connection mirroring. The advisory lists vulnerable branches and versions: 15.0.0–15.1.0.3, 14.1.0–14.1.2.4, 13.1.0–13.1.3.3, 12.1.0–12.1.5.1, and 11.6.1–11.6.5.1. The issue is a control plane weakness in the default mirroring deployment m...

F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K17663061)

BIG-IP systems set up for connection mirroring in a high availability HA pair transfersensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5885 Impact On-path attackers ma...

F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K65720640)

BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5886 Impact On-path attackers m...

CVE-2020-12277

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

CVE-2020-12277

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

UBUNTU-CVE-2020-12277

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

CVE-2020-12277

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

Design/Logic Flaw

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

CVE-2020-12277

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated...

CVE-2020-12277

Affected software : GitLab 10.8–12.9. Vulnerability : GitLab could mirror a repository even when the mirror feature is not activated. The root cause is not detailed in the provided documents. Impact : Unauthorized repository mirroring as described in the CVE description. Remediation : GitLab rele...

PT-2020-13090 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 through 12.9 Description: The issue allows someone to mirror a repository even if the feature is not activated. Recommendations: For GitLab versions 10.8 through 12.9, update to a version that contains a fix for this issu...

Cloud Native Application Development Enables New Levels of Security Visibility and Control

We are in unique times and it’s important to support each other through unique ways. Snyk is providing a community effort to make a difference through AllTheTalks.online, and Trend Micro is proud to be a sponsor of their virtual fundraiser and tech conference. In today’s threat landscape new clou...

lftp: particular remote file names may lead to current working directory erased

It has been discovered that lftp does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker-controlled FTP server, resulting in the removal of all files...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary File Read when Moving an Issue Path Traversal in NPM Package Registry SSRF on Project Import External Users Can Create Personal Snippet Triggers Decription Can be Updated by Other Maintainers in Project Information Disclosure on Confidential Issues Moved to Private...

Huawei EulerOS: Security Advisory for lftp (EulerOS-SA-2020-1259)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for rmt-server (openSUSE-SU-2019:1824-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...