The vulnerability of the libpq library in the PostgreSQL database management system allows a hacker to execute a type of “man-in-the-middle” attack.

The vulnerability of the libpq library in the PostgreSQL database management system is related to the lack of mandatory use of TLS connections. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” type attack...

tomcat: Host name verification missing in WebSocket client

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88...

Explained: How New 'Delegated Credentials' Boosts TLS Protocol Security

Mozilla, in partnership with Facebook, Cloudflare, and other IETF community members, has announced technical specifications for a new cryptographic protocol called "Delegated Credentials for TLS." Delegated Credentials for TLS is a new simplified way to implement "short-lived" certificates withou...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

DEBIAN-CVE-2019-5010

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted...

chromium-browser: IP address spoofing to servers

Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS connections...

The vulnerability of the TLS (Transport Layer Security) protocol implementation in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the TLS Transport Layer Security protocol implementation in Windows operating systems is related to deficiencies in session fixation. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information by connecting...

Security Bulletin: TLS padding vulnerability affects IBM Netezza Performance Portal (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Netezza Performance Portal. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information...

The vulnerability of the Java Secure Socket Extension (JSSE) component of the OpenJDK project, a programming language for Java, allows attackers to gain access to confidential data.

The vulnerability of the Java Secure Socket Extension JSSE component of the OpenJDK project, a programming language, is related to errors in processing the attached OCSP response during TLS handshake. Exploiting this vulnerability can allow an attacker operating remotely to gain access to...

PT-2019-11840 · Jenkins · Jenkins Cadence Vmanager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cadence vManager Plugin versions prior to 2.7.1 Description: The issue concerns the disabling of SSL/TLS and hostname verification globally for the Jenkins master JVM. This affects the security of the Jenkins master JVM, potentially...

October 15, 2019—KB4520012 (Preview of Monthly Rollup)

None None...

October 15, 2019—KB4520015 (Preview of Monthly Rollup)

None None...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

Microsoft Windows Transport Layer Security Spoofing Vulnerability

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. To exploit the vulnerability, an attacker would have to conduct a...

KB4520004: Windows 10 Version 1709 October 2019 Security Update

The remote Windows host is missing security update 4520004. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. CVE-2019-1340 - A spoofing vulnerability exists...

KB4519998: Windows 10 Version 1607 and Windows Server 2016 October 2019 Security Update

The remote Windows host is missing security update 4519998. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user...

KB4520011: Windows 10 October 2019 Security Update

The remote Windows host is missing security update 4520011. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge HTML-based. The vulnerability could corrupt...