CVE-2021-26530

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

Design/Logic Flaw

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 compiled with mbedTLS support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

CVE-2021-26530

CVE-2021-26530 describes a vulnerability in Cesanta Mongoose HTTPS server 7.0 when compiled with OpenSSL. The vulnerable component is the mg_tls_init function, which allows a remote out-of-bounds write via a connection request after the memory pool is exhausted. The Connected documents confirm th...

CVE-2021-26530

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

CVE-2021-26529

The CVE-2021-26529 issue affects Cesanta Mongoose HTTPS server (versions 7.0 and 6.7–6.18 compiled with mbedTLS). The root cause is an out-of-bounds write in mg_tls_init triggered by a connection request after memory pool exhaustion, enabling a remote write condition. Documents indicate this is a...

PT-2021-17025

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose HTTPS server version 7.0 Description The issue concerns a remote out-of-bounds OOB write attack via a connection request after exhausting the memory pool. This is related to the mg tls init function in the Cesanta Mongoose HTT...

PT-2021-17024

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose HTTPS server versions 6.7 through 7.0 Description The mg tls init function in the Cesanta Mongoose HTTPS server is vulnerable to a remote out-of-bounds OOB write attack via a connection request after exhausting the memory pool...

CVE-2021-26530: Out-of-bounds Write

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

Two Critical Flaws — CVSS Score 10 — Affect Dell Wyse Thin Client Devices

A team of researchers today unveiled two critical security vulnerabilities in Dell Wyse Thin clients that could have potentially allowed attackers to remotely execute malicious code and access arbitrary files on affected devices. The flaws, which were uncovered by healthcare cybersecurity provide...

Node.js: Node.js: use-after-free in TLSWrap

Node.js: use-after-free in TLSWrap Node v14.11.0 Current is vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method...

Downloads Resources over HTTP in macaca-chromedriver-zxa

Affected versions of macaca-chromedriver-zxa insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

Design/Logic Flaw

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery...

Circle with Disney Rclient SSL TLD MITM Vulnerability(CVE-2017-2911)

Summary An exploitable vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this...

CVE-2017-2913

An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...

Design/Logic Flaw

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate...

Design/Logic Flaw

An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...

CVE-2017-2911

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...

CVE-2017-2911

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...