4121 matches found
Secomea 多款产品加密问题漏洞
Secomea GateManager and Secomea SiteManager are both products of Secomea, Denmark.GateManager is a remote access server product.Secomea SiteManager is a software application. Secomea SiteManager is a software application that provides a remote maintenance function for industrial equipment. A...
PT-2022-2695
Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description The issue is related to how libcurl handles previously used connections in a connection pool for subsequent transfers. When a TLS or SSH-related option is changed, it should prohibit the reus...
OESA-2022-1622 tomcat security update
The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...
CVE-2022-20805
A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway SWG could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sev...
Exploit for CVE-2022-21449
CVE-2022-21449-TLS-PoC CVE-2022-21449 also dubbed Psychic Si...
The vulnerability of the SSL/TLS SSLWolf library, related to information disclosure due to incompatibilities, allows attackers to gain access to confidential data.
The vulnerability of the SSL/TLS library WolfSSL is related to the use of Base64 decoding functions with non-persistent execution time. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...
curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols
A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...
tomcat: Infinite loop while reading an unexpected TLS packet when using OpenSSL JSSE engine
A flaw was found in Apache Tomcat. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet can trigger an infinite loop, resulting in a denial of service. The highest threat from this vulnerability is to system availability...
golang: crypto/tls: certificate of wrong type is causing TLS client to panic
A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...
The vulnerability of the mbedtls_ssl_read function in TLS and SSL implementations allows a attacker to compromise data integrity.
The vulnerability of the mbedtlssslread function in TLS and SSL protocols is related to the absence of buffer zeroing. Exploiting this vulnerability allows a remote attacker to compromise data integrity...
The vulnerability of TLS and SSL Mbed TLS implementations lies in the exposure of information due to incompatibilities, allowing attackers to gain access to confidential data.
The vulnerability of TLS and SSL Mbed TLS implementations lies in the dependence of the instruction’s execution time on the data of that instruction. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...
The vulnerability of TLS and SSL Mbed TLS implementations lies in errors in the certificate validation process, which allows attackers to compromise the integrity of data.
The vulnerability of TLS and SSL Mbed TLS implementations is related to the incorrect comparison of NULL with an empty array. Exploiting this vulnerability allows a remote attacker to compromise data integrity...
The vulnerability of TLS and SSL Mbed TLS implementations lies in errors in the certificate validation process, which allows attackers to compromise the integrity of data.
The vulnerability of TLS and SSL Mbed TLS implementations is related to the incorrect use of the revocationDate check. Exploiting this vulnerability allows a remote attacker to compromise the integrity of data...
The vulnerability of TLS and SSL Mbed TLS implementations lies in the transmission of encrypted-protected information in an unencrypted form, allowing attackers to gain access to confidential data.
The vulnerability of TLS and SSL Mbed TLS implementations lies in the fact that the countermeasure “Lucky 13” does not correctly handle cases involving hardware acceleration. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...
envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation...
The vulnerability of TLS and SSL Mbed TLS implementations lies in the exposure of information due to incompatibilities, allowing attackers to gain access to confidential data.
The vulnerability of TLS and SSL Mbed TLS implementations is related to the disclosure of information due to incompatibility. Exploiting this vulnerability allows an attacker to gain access to confidential data...
The vulnerability of the mbedtls_mpi_exp_mod function in implementations of TLS and SSL protocols allows a attacker to cause a service failure.
The vulnerability of the mbedtlsmpiexpmod function in TLS and SSL protocol implementations is related to the lack of data size limitations during calculations. Exploiting this vulnerability allows a remote attacker to cause service failures...
CVE-2021-3422
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 version...
golang: crypto/tls: certificate of wrong type is causing TLS client to panic
A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...
OWASP Zed Attack Proxy 信任管理问题漏洞
OWASP Zed Attack Proxy ZAP is an open source web application security scanner from the OWASP Foundation in the United States. It is intended for use by people new to application security as well as professional penetration testers. A trust management issue vulnerability exists in the w2022-03-21...