Intel Security Library 安全漏洞

Intel Security Library is the Intel Security Library for data center applications from Intel Corporation. A security vulnerability exists in the IntelR Security Library prior to version 3.3, which stems from a key exchange in the library that is not physically authenticated and could allow an...

CVE-2021-0133: Undefined Security Weakness

Key exchange without entity authentication in the IntelR Security Library before version 3.3 may allow an authenticated user to potentially enable escalation of privilege via network access...

PT-2021-12920

Name of the Vulnerable Software and Affected Versions: IntelR Security Library versions prior to 3.3 Description: The issue is related to key exchange without entity authentication, which may allow an authenticated user to potentially enable escalation of privilege via network access...

IKE / ISAKMP Service Detection (UDP)

UDP based detection of services supporting the Internet Key Exchange IKE Protocol / Internet Security Association and Key Management Protocol ISAKMP. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

Cisco Firepower Threat Defense 1000 Series Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher...

Cisco Adaptive Security Appliance Software Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Adaptive Security Appliance ASA Software for Cisco Firepower 1000 is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely...

ISC BIND GSS-TSIG SPNEGO Buffer Overflow (CVE-2021-25216)

According to its self-reported version, the ISC Bind present on the remote host is affected by a buffer overflow vulnerability: - GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between...

GHSA-2FW4-MGQ9-39CX Code Injection in oauth2-server

"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...

SUSE: Security Advisory (SUSE-SU-2017:0607-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3882-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29997

An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE...

PT-2021-2260 · Cisco · Cisco Asr 5000 Series

Name of the Vulnerable Software and Affected Versions: Cisco ASR 5000 Series Software StarOS affected versions not specified Description: A vulnerability in the ipsecmgr process could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This issue is due to...

PT-2021-6078

Name of the Vulnerable Software and Affected Versions Go versions through 1.16.5 Description The issue arises from insufficient certificate authentication in the crypto/tls package of the Go programming language. This can be exploited by a remote attacker to cause a denial of service. Specificall...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in kex_agree_instr

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=6011743157485568 Project: libssh2 Fuzzing Engine: afl Fuzz Target: ssh2clientfuzzer Job Type: aflasanlibssh2 Platform Id: linux Crash Type:...

UBUNTU-CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

Cryptographic Issues

Overview elliptic is a fast elliptic-curve cryptography implementation in plain javascript. Affected versions of this package are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the deriv...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in ecdh_sha2_nistp

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5469642053255168 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type:...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in kex_agree_instr

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=4781977985220608 Project: libssh2 Fuzzing Engine: honggfuzz Fuzz Target: ssh2clientfuzzer Job Type: honggfuzzasanlibssh2 Platform Id: linux Crash Type:...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

CVE-2020-27272

SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apps doesn't use adequate measures to authenticate the pump before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop t...