9465 matches found
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
Design/Logic Flaw
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
CVE-2019-20894 : Traefik 2.x can allow HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an ERR_BAD_SSL_CLIENT_AUTH_CERT would be expected. This describes a gap in mutual TLS authentication that could expose confidentiality to a man-in-the-middle. The prov...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2019-20894
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2020-15502
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...
CVE-2020-15502
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...
Code injection
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...
CVE-2020-15502
The CVE-2020-15502 entry describes an information disclosure in the DuckDuckGo mobile apps: versions 5.58.0 for Android and 7.47.1.0 for iOS send hostnames of visited sites inside HTTPS .ico requests to duckduckgo.com, potentially exposing visit data to a Potentially Unwanted Endpoint. The core i...
CVE-2020-15502
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...
CVE-2019-20894: Improper Certificate Validation
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...
CVE-2020-15502: Exposure of Sensitive Information to an Unauthorized Actor
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has...
Man-in-the-Middle (MitM)
fastdfs-client is vulnerable to man-in-the-middle MitM. The vulnerability is possible because it does not use a secure channel HTTPS to download dependencies in Maven Build, allowing an MitM to intercept the channel to inject malicious code into the library to infect the builds being produced...
CVE-2020-14058
CVE-2020-14058 affects Squid before 4.12 and 5.x before 5.0.3. The DoS condition occurs when opening a TLS connection to an attacker-controlled HTTPS server due to using a potentially dangerous function and mapping unrecognized error values to NULL, with later code expecting valid error strings. ...
CVE-2020-14058
An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs becaus...
Security Vulnerabilities fixed in Thunderbird 68.10.0 — Mozilla
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash.Note: this issue only affects Firefox on ARM64 platforms. Manipulating individual parts of a URL object could have caused an...
Espionage - A Network Packet And Traffic Interceptor For Linux. Spoof ARP & Wiretap A Network
Espionage is a network packet sniffer that intercepts large amounts of data being passed through an interface. The tool allows users to to run normal and verbose traffic analysis that shows a live feed of traffic, revealing packet direction, protocols, flags, etc. Espionage can also spoof ARP so,...
Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
USN-4402-1: curl vulnerabilities
Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered that curl incorrectly handled certain credentials. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. CVE-2020-8169 It was discovered that curl incorrectl...