446 matches found
CVE-2020-13277
An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5...
CVE-2020-13277
Removed by vendor...
PT-2020-13418 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.6 through 13.0.5 Description: An authorization issue in the mirroring logic allowed read access to private repositories. Recommendations: For GitLab CE/EE versions 10.6 through 13.0.5, update to a version later than...
GitLab: An attacker can run pipeline jobs as arbitrary user
Summary An attacker can run arbitrary pipeline jobs as a victim user. This means the attacker can access the user private repositories, member only repositories, registry, etc... by using the victim CIJOBTOKEN token. This is only my recent research and I wanted to report it as soon as possible. I...
CVE-2020-5885
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5886
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5884
On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability HA pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring...
CVE-2020-5886
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5884
On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability HA pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring...
CVE-2020-5884
On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability HA pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring...
CVE-2020-5886
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
Design/Logic Flaw
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5885
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5886
CVE-2020-5886 affects BIG-IP products with connection mirroring in HA setups. Affected versions include 12.1.0–12.1.5, 13.1.0–13.1.3, 14.1.0–14.1.2, and 15.0.0–15.1.0.1. The vulnerability enables on-path attackers to read or modify Diffie-Hellman parameters by transferring sensitive cryptographic...
CVE-2020-5885
On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...
CVE-2020-5885
CVE-2020-5885 affects F5 BIG-IP in HA connection mirroring setups. A control plane issue allows on-path attackers to read/modify keys used for EXPORT-based cipher suites by transferring sensitive cryptographic objects over an insecure channel. Affected versions and fixes per vendor advisories: BI...
CVE-2020-5884
CVE-2020-5884 affects BIG-IP high availability (HA) state/connection mirroring. The advisory lists vulnerable branches and versions: 15.0.0–15.1.0.3, 14.1.0–14.1.2.4, 13.1.0–13.1.3.3, 12.1.0–12.1.5.1, and 11.6.1–11.6.5.1. The issue is a control plane weakness in the default mirroring deployment m...
F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K65720640)
BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5886 Impact On-path attackers m...
F5 Networks BIG-IP : BIG-IP SSL state mirroring vulnerability (K17663061)
BIG-IP systems set up for connection mirroring in a high availability HA pair transfersensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.CVE-2020-5885 Impact On-path attackers ma...