MiracleLinux 9 : dotnet6.0-6.0.122-1.el9.ML.1 (AXSA:2023-6423:23)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6423:23 advisory. dotnet: Denial of Service with Client Certificates using .NET Kestrel CVE-2023-36799 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : dotnet7.0-7.0.111-1.el8.ML.1 (AXSA:2023-6419:26)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6419:26 advisory. dotnet: Denial of Service with Client Certificates using .NET Kestrel CVE-2023-36799 Tenable has extracted the preceding description block directly from the...

CVE-2025-15346 wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

A vulnerability in the handling of verifymode = CERTREQUIRED in the wolfssl Python package wolfssl-py causes client certificate requirements to not be fully enforced. Because the WOLFSSLVERIFYFAILIFNOPEERCERT flag was not included, the behavior effectively matched CERTOPTIONAL: a peer certificate...

CVE-2025-26787

An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth...

BIT-ELASTICSEARCH-2025-37731 Elasticsearch Improper Authentication

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

CVE-2025-37731

A flaw was found in Elasticsearch. This vulnerability allows user impersonation via specially crafted client certificates signed by a legitimate, trusted Certificate Authority CA. Mitigation To reduce the risk of exploitation, ensure that the Certificate Authority CA used for the Elasticsearch PK...

Linux Distros Unpatched Vulnerability : CVE-2025-37731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to hav...

GHSA-M9GH-789G-Q5PV Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the PKI realm. An attacker can impersonate other users by presenting specially crafted client certificates signed by a trusted Certificate Authority. Note: This is only exploitable if the attacker...

Improper Certificate Validation

Overview org.elasticsearch.plugin:x-pack-security is an Elasticsearch Expanded Pack Plugin - Security Affected versions of this package are vulnerable to Improper Certificate Validation via the PKI realm. An attacker can impersonate other users by presenting specially crafted client certificates...

CVE-2025-37731

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

CVE-2025-37731 Elasticsearch Improper Authentication

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

CVE-2025-37731

CVE-2025-37731 affects Elasticsearch PKI realm authentication: impersonation possible via specially crafted client certificates signed by a trusted CA. Affected: Elasticsearch 7.0.x before 8.19.8, 9.0.x before 9.1.8, 9.2.x before 9.2.2. Root cause is improper authentication in the PKI realm. Impa...

Elasticsearch 安全漏洞

Elasticsearch is a search and analytics engine from Dutch company Elastic. A security vulnerability exists in Elasticsearch that stems from improper authentication and could lead to user impersonation via specially crafted client certificates...

PT-2025-51212

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw exists in the PKI realm authentication process within Elasticsearch. This issue allows a malicious actor to impersonate users by presenting a specially crafted client certificate...

CVE-2025-63729

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO3.7L3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder...

CVE-2025-63729

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO3.7L3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder...

CVE-2025-63729

CVE-2025-63729 affects Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517. The vulnerability allows extraction of SSL private key, CA certificate, SSL certificate, and client certificates stored in PEM format in the firmware’s etc folder. Root cause details are not explicitly provided beyond the...

CVE-2025-40744

Summary: CVE-2025-40744 affects Solid Edge SE2025 prior to V225.0 Update 11, where the License Service endpoint fails to properly validate client certificates, enabling a potential man-in-the-middle for unauthenticated attackers. Both Red Hat and PT security sources confirm the issue and the affe...