2822 matches found
BIT-GOLANG-2022-41724 Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session...
CentOS 9 : containernetworking-plugins-1.3.0-2.el9
The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the containernetworking-plugins-1.3.0-2.el9 build changelog. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a...
Buffer Over-read
Overview Affected versions of this package are vulnerable to Buffer Over-read when callback functions are enabled through the optional WOLFSSLCALLBACKS flag. An attacker can read 5 bytes from the heap via malicious TLS 1.3 connection. Remediation Upgrade wolfssl to version 5.6.6 or higher...
SUSE CVE-2024-25710
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...
DEBIAN-CVE-2024-25710
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...
UBUNTU-CVE-2024-25710
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...
CVE-2023-6937
wolfSSL prior to 5.6.6 did not check that messages in one DTLS record do not span key boundaries. As a result, it was possible to combine DTLS messages using different keys into one DTLS record. The most extreme edge case is that, in DTLS 1.3, it was possible that an unencrypted DTLS 1.3 record...
PT-2024-20565 · G5Theme · Ere Recently Viewed – Essential Real Estate Add-On
Name of the Vulnerable Software and Affected Versions: ERE Recently Viewed – Essential Real Estate Add-On versions 1.3 and earlier Description: The issue is related to the deserialization of untrusted data in the G5Theme ERE Recently Viewed – Essential Real Estate Add-On. There is no information...
CVE-2023-50962
IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...
CVE-2023-50328
IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110...
CVE-2023-50937
IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117...
CVE-2023-50933
IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 275113...
PT-2024-13903 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to an inadequate account lockout setting in IBM PowerSC, which could allow a remote attacker to brute force account credentials. Recommendations: For versions 1.3 through...
PT-2024-14021 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: A remote attacker could hijack the clicking action of the victim by persuading them to visit a malicious Web site, potentially launching further attacks against the victim. Recommendations: Fo...
PT-2024-14019 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue allows an authenticated user to impersonate another user on the system because sessions are not invalidated after logout. Recommendations: For IBM PowerSC versions 1.3 through 2.1,...
PT-2024-14020 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For IBM PowerSC versio...
PT-2024-13904 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of insecure HTTP methods, which could allow a remote attacker to perform unauthorized file request modification. Recommendations: For versions 1.3 through 2.1,...
PT-2024-14032 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue concerns the lack of implementation of the "HTTP Strict Transport Security" HSTS web security policy mechanism in the MFA component. This mechanism is designed to protect against...
PT-2024-6579 · Ibm · Ibm Powersc
Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of Cross-Origin Resource Sharing CORS in IBM PowerSC, which could allow an attacker to carry out privileged actions and retrieve sensitive information. This is...
