23 matches found
PT-2026-120550
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in TLS hostname verification allows a server certificate to be validated against an IP address different from the one the client connected to. This occurs whe...
PT-2026-120548
Name of the Vulnerable Software and Affected Versions Node.js versions 26.x Node.js versions 24.x Node.js versions 22.x Description A flaw in DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This occurs because the name i...
PT-2026-120549
Name of the Vulnerable Software and Affected Versions Node.js versions 24.x Node.js versions 26.x Description A flaw in TLS hostname verification allows a connection to an IPv4 address to be authenticated using a certificate that lacks a matching IP address Subject Alternative Name SAN when the...
PT-2026-120551
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in TLS hostname verification occurs when a client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1. The...
Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint inconsistency in RFC 5280 implementation
Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. Description The observed...
PSF-0000-CVE-2026-8328
The ftpcp function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv was patched to replace server-supplied PASV host addresses with the actual peer address getpeername0, ftpcp still calls parse227 directly and passes the raw attacker-controllable IP address and port t...
Open5GS security vulnerabilities
Open5GS is an open-source implementation of 5G Core and EPC in C language, which serves as the core network for Lte/Nr networks. Versions of Open5GS 2.7.7 and earlier contain security vulnerabilities. These vulnerabilities stem from the operation of the bsfsessaddbyipaddress function in the...
PT-2026-120553
Name of the Vulnerable Software and Affected Versions Google Brotli versions 1.0.3 through 1.2.0 Node.js versions prior to 22.23.4 Node.js versions prior to 24.22.1 Node.js versions prior to 26.12.1 .NET versions prior to 8.0.33 .NET versions prior to 9.0.22 .NET versions prior to 10.0.14...
EUVD-2019-11403
Malware in sbrugna...
EUVD-2015-9175
Malware in sbrugna...
EUVD-2017-15223
Malware in sbrugna...
EUVD-2021-23492
Malware in sbrugna...
EUVD-2016-4208
Malware in sbrugna...
TOTOLink T6 System Arbitrary Command Execution
The vulnerability of the cckeckKeepAlive function in the TOTOLink T6 mesh-system’s software lies in the lack of measures taken to neutralize special elements during the processing of the ipAddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Ruijie Networks RG-UAC Operating System Command Injection Vulnerability
Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC version 20240428 and earlier versions,...
K85307687: cURL and libcurl vulnerabilities CVE-2014-3613, CVE-2014-3707, and CVE-2014-8150
Security Advisory Description CVE-2014-3613 cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site...
PT-2022-6972 · D Link · D-Link Dap-1325
Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this issue. Th...
CVE-2015-9335
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...
