Siemens OZW672 and OZW772 Data Read/Write Vulnerability

Siemens OZW672 and OZW772 are both building controller products from Siemens, Germany. A data read/write vulnerability exists in the Siemens OZW672 and OZW772. An attacker can exploit the vulnerability to read and write historical measurement data under certain conditions, or read and modify data...

Siemens OZW672 and OZW772 Man-in-the-Middle Attack Vulnerabilities

Siemens OZW672 and OZW772 are both building controller products from Siemens, Germany. A man-in-the-middle attack vulnerability exists in the Siemens OZW672 and OZW772. This allows an attacker to read and manipulate data in a TLS session while performing a man-in-the-middle MITM attack...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

openssl: Possible integer overflow vulnerabilities in codebase

Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash...

freeradius: TLS resumption authentication bypass

An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session...

FreeRADIUS Server TLS Authentication Bypass Vulnerability

FreeRadius is a set of software from the FreeRADIUS Server project that implements the RADIUS protocol. The software is mainly used for account authentication management, bookkeeping management and Internet account management, etc. and contains a Radius server, a client library for BSD protocol...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

CVE-2016-6087

IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918...

The vulnerability of the implementation of SSL and TLS protocols in Cisco Adaptive Security Appliance software allows a perpetrator to trigger a system reboot.

The vulnerability of the implementation of SSL and TLS protocols in Cisco Adaptive Security Appliance software exists due to improper processing of SSL and TLS packets. Exploiting this vulnerability can allow a malicious actor to trigger a system reboot using a specially crafted network packet...

FreeRADIUS Security Bypass Vulnerability

FreeRadius is a set of software from the FreeRADIUS Server project that implements the RADIUS protocol. The software is mainly used for account authentication management, bookkeeping management and Internet account management, etc. and contains a Radius server, a client library for BSD protocol...

UBUNTU-CVE-2017-9148

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers such as malicious 802.1X supplicants to bypass authentication via PE...

Apple macOS Sierra EAP-TLS Certificate Validation Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. A certificate validation vulnerability exists in Apple macOS EAP-TLS, which can be exploited by remote attackers to bypass security restrictions and obtain sensitive information...

Google Chrome Security Bypass Vulnerability (CNVD-2017-07170)

Google Chrome is a web browser developed by the American company Google Google. A security bypass vulnerability exists in Google Chrome, which originates when the program caches a TLS session before validating a certificate. An attacker can exploit the vulnerability to decrypt TLS sessions...

May 16, 2017—KB4019217 (Preview of Monthly Rollup)

None None...

LibreSSL TLS Certificate Validation Vulnerability

LibreSSL is an open source implementation of the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A certificate validation vulnerability exists in LibreSSL TLS. A remote attacker can exploit this vulnerability by relying on SSLgetverifyresult, resulting in LibreSSL lacking TLS...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...