46 matches found
curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path
Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...
Photon OS 5.0: Curl PHSA-2026-5.0-91-0856
An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0856. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP stapling process with Apple SecTrust. An attacker can cause the client to accept invalid or revoked server certificates by exploiting the failure to properly detect OCSP response problems. Not...
CVE-2026-7009
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...
CURL-CVE-2026-7009 OCSP stapling bypass with Apple SecTrust
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...
CVE-2026-7009
creationtimestamp| type| source ---|---|--- 2026-04-29 07:11:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkmkahhjdz2v 2026-04-29 12:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4vufiap2k...
AlmaLinux 8 : grafana-pcp (ALSA-2026:7009)
The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:7009 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the AlmaLinux securi...
RockyLinux 8 : grafana-pcp (RLSA-2026:7009)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:7009 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the RockyLinux...
Oracle Linux 8 : grafana-pcp (ELSA-2026-7009)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-7009 advisory. 5.1.1-13 - Resolves RHEL-156641: CVE-2026-25679 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...
EUVD-2019-7009
Malware in sbrugna...
EUVD-2021-0670
Malware in sbrugna...
MAL-2025-7009 Malicious code in 3x4abc (npm)
The package 3x4abc was found to contain malicious code...
Mageia: Security Advisory (MGASA-2025-0049)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-7009-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2024-a455bea9ca)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-7009
creationtimestamp| type| source ---|---|--- 2024-08-06 07:28:36+00:00| seen| https://t.me/cvedetector/2522...
CVE-2023-7009
Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be...
CVE-2023-7009
Sciener-based locks are vulnerable to a security flaw where the firmware supports plaintext message processing over Bluetooth Low Energy . This allows an attacker with Bluetooth proximity to send unencrypted malicious commands less than 16 bytes in length. The lock processes these commands as if ...
BIT-ELASTICSEARCH-2020-7014
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...
SUSE CVE-2020-7014
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...