4683 matches found
CVE-2018-19635
CA Service Desk Manager versions 14.1 and 17 contain a privilege-escalation vulnerability in the user interface (CVE-2018-19635). The connected sources confirm the affected product and impact but do not provide exploit vectors, affected components beyond the UI, root cause specifics, or a publish...
PT-2019-9882
Name of the Vulnerable Software and Affected Versions CA Service Desk Manager versions 14.1 through 17 Description A malicious actor can escalate privileges in the user interface due to a vulnerability. Recommendations For CA Service Desk Manager versions 14.1 through 17, at the moment, there is ...
PT-2019-9881
Name of the Vulnerable Software and Affected Versions CA Service Desk Manager versions 14.1 through 17 Description A malicious actor can access survey information due to a vulnerability in the software. Recommendations For versions 14.1 through 17, update to a version that contains a fix for this...
CVE-2018-19634: Improper Access Control
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...
CVE-2018-19635: Improper Privilege Management
CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...
Authentication Bypass
pki-core is vulnerable to authentication bypass attacks. The vulnerability exists as it was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the...
Man-in-the-Middle (MitM)
gnutls is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is 1 not yet...
Authorization Bypass
katello is vulnerable to authorization bypass attacks. The vulnerability exists as modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions 666 for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by...
Authorization Bypass
gnutls is vulnerable to authorization bypass attacks. The vulnerability exists as GnuTLS before 2.7.6, when the GNUTLSVERIFYALLOWX509V1CACRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a...
Man-in-the-Middle (MitM)
Ruby is vulnerable to man-in-the-middle attack. The SSL client's hostname identity check does not properly handle certificates with hostnames containing NULL bytes. A remote attacker, who has obtained a specific certificate that is signed by an trusted CA, is able to exploit the vulnerability to...
SSL Certificate Validity - Duration
The CA/Browser Forum has passed a resolution setting the maximum validity period for SSL/TLS subscriber certificates via ballot 193. Certificates issued after March 1, 2018 may not be valid longer than 825 days. Certificates issued after July 1, 2016 through March 1, 2018 may not be valid longer...
mkcert: valid HTTPS certificates for localhost
or for any other names The web is moving to HTTPS, preventing network attackers from observing or injecting page contents. But HTTPS needs TLS certificates, and while deployment is increasingly a solved issue thanks to the ACME protocol and Let's Encrypt, development still mostly ends up happenin...
Fedora 28 : ca-certificates (2018-ff58779d1b)
This is an update to Mozilla's CA certificates list version 2.26, which has been published as part of Mozilla NSS 3.39. For additional details, please refer to the NSS 3.39 release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.39 releasenotes Note that Tenable Network...
Fedora 29 : ca-certificates (2018-da018e6fb9)
This is an update to Mozilla's CA certificates list version 2.26, which has been published as part of Mozilla NSS 3.39. For additional details, please refer to the NSS 3.39 release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.39 releasenotes Note that Tenable Network...
Fedora 28 : ca-certificates (2018-6d91fc0518)
This is an update to version 2.24 of the Mozilla CA trust list, which has been published as part of the NSS 3.37 release. Please refer to the upstream release notes for the changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.37 releasenotes Note that Tenable Network Securi...
SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2017:0855-1)
This update for nodejs4 fixes the following issues : - New upstream LTS release 4.7.3 The embedded openssl sources were updated to 1.0.2k CVE-2017-3731, CVE-2017-3732, CVE-2016-7055, bsc1022085, bsc1022086, bsc1009528 - No changes in LTS version 4.7.2 - New upstream LTS release 4.7.1 - build:...
SQL injection vulnerability in Laoban CMS V2.0 ca***.php page
Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. A SQL injection vulnerability exists in the Laoban CMS V2.0ca.php page. An attacker can exploit this vulnerability to obtain sensitiv...
IBM Cloud Private Information Disclosure Vulnerability
IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. An information disclosure vulnerability exists in IBM Cloud Private version 2.1.0, which originates from a program that sets the CA Private Key to ...
