Tag: security vulnerabilities

  • GitLab Urges Update for High-Risk Flaws in Repositories and Services

    GitLab Urges Update for High-Risk Flaws in Repositories and Services

    Key Takeaways

    1. GitLab has released patch updates (versions 18.8.4, 18.7.4, and 18.6.6) for high-severity security issues in its Community Edition (CE) and Enterprise Edition (EE) platforms.
    2. A critical vulnerability (CVE-2025-7659) in GitLab’s Web IDE could allow unauthenticated attackers to capture access tokens and access private repositories.
    3. The updates fix multiple denial-of-service vulnerabilities, including CVE-2025-8099 and CVE-2026-0958, which could crash servers and drain system resources.
    4. Additional security fixes address cross-site scripting and injection vulnerabilities, along with medium and lower-severity flaws in Markdown processing and authorization.
    5. Upgrading to the latest version is crucial for security, and administrators should expect some downtime during the patch process, especially for single-node installations.

    GitLab has put out new patch updates that tackle several high-severity security issues affecting its Community Edition (CE) and Enterprise Edition (EE) platforms. The updates are now available as versions 18.8.4, 18.7.4, and 18.6.6. The company is urging all self-managed installations to upgrade without delay. GitLab has already implemented the patched versions, and customers using GitLab Dedicated don’t need to take any steps.

    Critical Vulnerabilities Addressed

    One of the most significant problems fixed is CVE-2025-7659, a high-severity vulnerability (CVSS score of 8.0) related to inadequate validation within GitLab’s Web IDE. GitLab mentions that this flaw could let unauthenticated attackers capture access tokens and potentially access private repositories. The patch also addresses multiple denial-of-service vulnerabilities, such as CVE-2025-8099, which could allow attackers to crash servers through repeated GraphQL queries, and CVE-2026-0958, which could drain system resources by skipping JSON validation middleware.

    Additional Security Fixes

    The update also resolves cross-site scripting and injection vulnerabilities like CVE-2025-14560 and CVE-2026-0595. These issues could enable attackers to inject harmful scripts or alter content under certain scenarios. Moreover, various medium-severity vulnerabilities related to Markdown processing, dashboards, and server-side request forgery (SSRF) have been fixed, along with several lower-severity flaws in authorization and validation.

    GitLab clarifies that the affected versions encompass all builds from various release branches prior to the newly launched patches. The firm points out that details on security vulnerabilities are usually disclosed 30 days after a fix has been issued. The organization stresses that upgrading to the latest supported version is vital for keeping deployments secure.

    Impact on Availability

    The patch release also includes database migrations, which might temporarily affect availability. For single-node installations, some downtime is anticipated during the upgrade, while multi-node deployments can finish the update without downtime if they follow the suggested upgrade protocols.

    GitLab typically adheres to a regular patch release timetable twice a month but can issue extra updates when critical vulnerabilities are found. The company recommends that administrators check release notes, test upgrades in staging environments, and apply the latest patches as quickly as possible to minimize potential exploitation risks.

    Source:
    Link

     

    Tags: , ,
  • Security Researchers Hack Xplora Smartwatches: Key Vulnerability

    Security Researchers Hack Xplora Smartwatches: Key Vulnerability

    Key Takeaways

    1. Xplora is recognized as a top brand in kids’ smartwatches, but security issues have been uncovered by researchers.
    2. A study revealed that Xplora smartwatches can be breached quickly, with a common cryptographic key shared among devices.
    3. Hackers can easily access personal data, including private messages and location information, using the watch’s IMEI number.
    4. Xplora delayed necessary security updates, with only minor changes made despite being notified of the vulnerabilities.
    5. Parents face a dilemma between trusting Xplora’s security claims and using alternative secure communication methods for their children.

    Xplora has been recognized as a top player in the kids’ smartwatch industry. The Norwegian brand promotes its commitment to high security and transparency. In Norway, nearly one in five children aged 4 to 10 sport such a device. However, investigations from TU Darmstadt, a German university, reveal a much darker truth behind the marketing claims.

    Security Breach Findings

    In a Master’s thesis, Malte Vu studied a current Xplora smartwatch under Nils Rollshausen’s guidance. The time taken to breach the device’s security was alarmingly short. Within days, they activated the PIN-protected developer mode and extracted the software. Malte Vu was able to crack the necessary PIN code in just a few hours.

    The analysis afterwards uncovered a serious security issue, as the researchers discovered that all similar devices share a common cryptographic key.

    Universal Key Risks

    This shared key grants extensive data access. Hackers only need the watch’s IMEI number, a 15-digit identifier. The first 8 digits are the same for all units of a particular model, followed by a unique 6-digit serial number and a check digit at the end.

    During his presentation at 39C3, Rollshausen demonstrated how easy it would be to conduct an automated scan across a manufacturer’s entire IMEI range. Such a tool could potentially access data from all watches in stock. The implications are significant; unauthorized individuals could read private messages, intercept images and voice notes, or even manipulate location data. They could also send fake messages to the parent app pretending to be the child, creating two-way communication channels.

    Delays in Security Updates

    Despite being notified of these issues in May 2025, Xplora took a considerable amount of time to implement necessary changes. The first update in August merely increased the PIN length to 6 digits and restricted the number of failed attempts. It seems the company aimed to prevent researchers and hackers from accessing developer mode.

    However, the main security issue, the universal key, remained unaffected. After the manufacturer stopped responding to inquiries in October, the researchers involved reached out to Germany’s Federal Office for Information Security.

    A subsequent update at the end of October also failed to address the problems, and minor adjustments to the exploit were sufficient to regain complete access. Xplora has now promised a comprehensive security update for January 2026. It’s highly recommended to install this update right after it becomes available. Following several discussions with the manufacturer in late December 2025, Rollshausen is hopeful for a genuine solution.

    In a technical demonstration, Rollshausen also showed an alternative approach. He installed the secure messaging app Signal directly on the smartwatch. This highlights a critical issue: parents must currently choose between trusting the company’s claimed security or opting for a different secure communication method.

    Source:
    Link

     

    Tags: , ,