155 matches found
CVE-2023-45285 Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...
GO-2023-2383 Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...
CVE-2023-45285: Undefined Security Weakness
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...
CVE-2023-42579
Improper usage of insecure protocol i.e. HTTP in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middl...
CVE-2023-42579
Improper usage of insecure protocol i.e. HTTP in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middl...
Design/Logic Flaw
Improper usage of insecure protocol i.e. HTTP in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middl...
CVE-2023-42579
CVE-2023-42579 affects the SogouSDK used by the Chinese Samsung Keyboard on Android. The root issue is improper use of an insecure protocol (HTTP), enabling adjacent attackers to perform MITM interception of keystroke data. Affected versions are: Android 11 (before 5.3.70.1); Android 12 (before 5...
SAMSUNG Mobile devices security vulnerability
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices, which stems from the improper use of an insecure protocol in the SogouSDK for Chinese Samsung...
Ubuntu: Security Advisory (USN-6519-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-6519-2: EC2 hibagent update
USN-6519-1 added IMDSv2 support to EC2 hibagent. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: The EC2 hibagent package has been updated to add IMDSv2 support, as IMDSv1 uses an insecure protocol and is no longer recommended...
PT-2023-36324 · Amazon · Ec2 Hibagent
Name of the Vulnerable Software and Affected Versions: EC2 hibagent versions prior to the update that adds IMDSv2 support Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. The EC2 hibagent package has been updated to add IMDSv2 support...
USN-6519-1 ec2-hibinit-agent update
The EC2 hibagent package has been updated to add IMDSv2 support, as IMDSv1 uses an insecure protocol and is no longer recommended...
PT-2023-36323 · Amazon · Ec2 Hibagent
Name of the Vulnerable Software and Affected Versions: EC2 hibagent affected versions not specified Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. To address this, the EC2 hibagent package has been updated to add support for IMDSv2...
PT-2023-17096 · Quarkus · Quarkus
Name of the Vulnerable Software and Affected Versions: Quarkus affected versions not specified Description: A flaw was found in Quarkus, where Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used. This can allow attackers to access...
Siemens RUGGEDCOM ROX Use of a Broken or Risky Cryptographic Algorithm (CVE-2023-36749)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...
Broadcom RAID Controller Security Vulnerability
The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation. A security vulnerability exists in the Broadcom RAID Controller that stems from an insecure HTTP in the web interface that prevents the protection of the SESSIONID cookie with the SameSite attribute...
Siemens RUGGEDCOM ROX Encryption Issue Vulnerability
RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A security vulnerability exists in the Siemens RUGGEDCOM ROX that stems from the affected device's web server supporting the insecure TLS 1.0 protocol...
CVE-2023-36749
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...