Medium: curl

Issue Overview: A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or...

SUSE-SU-2023:0759-1 Security update for perl-Net-Server

This update for perl-Net-Server fixes the following issues: - CVE-2013-1841: Fixed insufficient hostname access checking bsc808830...

SUSE-SU-2023:0746-1 Security update for perl-Net-Server

This update for perl-Net-Server fixes the following issues: - CVE-2013-1841: Fixed insufficient hostname access checking bsc808830...

CVE-2023-25283

A stack overflow vulnerability in D-Link DIR820LA1FW106B02 allows attackers to cause a denial of service via the reserveDHCPHostName1.1.1.0 parameter to lan.asp...

D-Link DIR820LA1 缓冲区错误漏洞

D-Link DIR820LA1 is a router from China-based AUO D-Link. A security vulnerability exists in version D-Link DIR820LA1FW106B02. An attacker can exploit this vulnerability to cause a denial of service via the reserveDHCPHostName1.1.1.0 parameter in lan.asp...

SUSE-SU-2023:0707-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2023-24329: Fixed blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.9.16: - python -m http.server no longer allows terminal control characters sent within a...

PT-2023-4187 · Check Point · Check Point Gaia Portal +1

Name of the Vulnerable Software and Affected Versions: Check Point Gaia Portal affected versions not specified Description: The issue is related to a command injection vulnerability in the Check Point Gaia Portal. It allows a local user to potentially escalate privileges using the Gaia Portal...

SUSE CVE-2023-1195

A use-after-free flaw was found in reconnsetipaddrfromhostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server-hostname to NULL, leading to an invalid pointer request...

CVE-2023-1195

A use-after-free flaw was found in reconnsetipaddrfromhostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server-hostname to NULL, leading to an invalid pointer request...

UBUNTU-CVE-2023-1195

A use-after-free flaw was found in reconnsetipaddrfromhostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server-hostname to NULL, leading to an invalid pointer request...

PT-2023-3479 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G firmware version 1.02B05 Description: The issue is related to a buffer overflow in the implementation of the HNAP1 protocol in the D-Link DIR-823G router's firmware. This occurs when processing the SetParentsControlInfo...

K15807: cURL and libcurl vulnerability CVE-2014-1263

Security Advisory Description curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.50...

K10027302: Libsoup vulnerability CVE-2018-12910

Security Advisory Description The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. CVE-2018-12910 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product...

CVE-2022-48307

It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack...

CVE-2022-48308

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

Palantir 信任管理问题漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Magritte-ftp prior to version 9.466.0, which originates from a hostname in an...

PT-2023-12920 · Unknown · Sls-Logging

Name of the Vulnerable Software and Affected Versions: sls-logging affected versions not specified Description: The issue arises from the misuse of the javax.net.ssl.SSLSocketFactory API, which fails to verify hostnames in TLS certificates. This could allow a malicious attacker in a privileged...

Palantir 信任管理问题漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Sls-logging prior to version 9.51.0 that originates from an unvalidated hostname i...

CVE-2022-48307

The CVE-2022-48307 entry concerns Magritte-ftp where hostnames were not verified in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. This allowed a network-positioned attacker to perform a man-in-the-middle attack, intercepting and potentially reading or modifying traff...

SUSE CVE-2004-0460

Buffer overflow in the logging capability for the DHCP daemon DHCPD for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service server crash and possibly execute arbitrary code via multiple hostname options in 1 DISCOVER, 2 OFFER, 3 REQUEST, 4 ACK, or 5 NAK messages,...