CVE-2018-5926

HP Remote Graphics Software (RGS) versions 7.5.0 and earlier contain a vulnerability in the certificate authentication process that could disclose information. Root cause: issues in certificate handling during authentication. Impact as per sources: potential information disclosure with high confi...

CloudBees Jenkins JMS Messaging Plugin Server Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . JMS Messaging Plugin is used in one of the...

SUSE SLES15 Security Update : dovecot23 (SUSE-SU-2019:0414-1)

This update for dovecot23 fixes the following issues : dovecot was updated to 2.3.3 release, bringing lots of bugfixes bsc1124356. Also the following security issue was fixed : CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed bsc1123022 The...

PT-2019-1772 · Dovecot +5 · Dovecot +5

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.2.36.1 Dovecot versions prior to 2.3.4.1 Description: The issue is related to errors in certificate authentication. A remote attacker with a valid certificate that has an empty username field could potentially use...

Fedora 29 : openssh (2019-f6ff819834)

This update fixes CVE-2018-20685 the first 'variant' and backports several fixes to unbreak ECDSA authentication from PKCS11, certificate authentication and so on. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

DEBIAN-CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

UBUNTU-CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

GHSA-3JQ8-JG75-RQV6 Cleartext Transmission of Sensitive Information in Apache nifi

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...

CVE-2018-17195

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...

CVE-2018-17195

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle MiTM attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access,...

Certificate Based Authentication on Gateway Insight

With Client Authentication enabled on an SSL virtual server, the NetScaler appliance asks for the Client Certificate during the SSL handshake. The appliance checks the certificate presented by the client for normal constraints, such as the issuer signature and expiration date. Here are some use...

HPSBGN03599 rev. 2 - Certificate Authentication Vulnerability in HP Remote Graphics Software

Potential Security Impact Information disclosure Source : HP, HP Product Security Response Team PSRT Reported by : Rowan Venables VULNERABILITY SUMMARY A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process. RESOLUTION HP has mitigated th...

DEBIAN-CVE-2018-16841

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call tallocfree twice on the same memory if the principal in a validly signed certificate does not match the principal ...

F5 Networks BIG-IP : BIG-IP Client SSL vulnerability (K43121447)

Attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by...

CVE-2018-6979

The VMware Workspace ONE Unified Endpoint Management Console A/W Console 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.5.0.16, 9.4.x prior to 9.4.0.22, 9.3.x prior to 9.3.0.25, 9.2.x prior to 9.2.3.27, and 9.1.x prior to 9.1.5.6 contains a SAML authentication bypass vulnerabili...

Xenmobile MAM enrollment fails-configuration does not support client certificate for authentication

Client certificate authentication is being used for MAM. Enrollment of new devices is failing MAM but successful for MDM. Secure Hub logs: ,ERROR 2,-X1MDMEnrollFlowController createSecureSessionblockinvoke,"Cert based setups are not supported for XME shared device, so we are blocking the...

Cisco ASA and FWSM Security Advisories

Overview On October 9, 2013, Cisco released two security advisorieshttp://www.us-cert.gov/ncas/current-activity/2013/10/10/Cisco-Releases-Security-Advisories concerning multiple vulnerabilities within software for the following components: Cisco Adaptive Security Appliance ASA...

openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication

OpenShift and Atomic Enterprise Ansible deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users to conne...

CVE-2017-3962

Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management NSM before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes...

openSUSE Security Update : curl (openSUSE-2018-589)

This update for curl to version 7.60.0 fixes the following issues : These security issues were fixed : - CVE-2018-1000300: Prevent heap-based buffer overflow when closing down an FTP connection with very long server command replies bsc1092094. - CVE-2018-1000301: Prevent buffer over-read that cou...