6036 matches found
Advisory ROSA-SA-2021-1909
Software: log4j 1.2.17 OS: Cobalt 7.9 CVE-ID: CVE-2019-17571 CVE-Crit: CRITICAL CVE-DESC: Log4j 1.2 includes a SocketServer class vulnerable to unreliable data deserialization, which can be used to remotely execute arbitrary code in conjunction with a deserialization gadget while listening to...
EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBD-MySQL (EulerOS-SA-2021-2072)
According to the versions of the perl-DBD-MySQL package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The DBD::mysql module through 4.043 for Perl uses the mysqlssl=1 setting to mean that SSL is optional even thou...
EulerOS Virtualization for ARM 64 3.0.2.0 : unbound (EulerOS-SA-2021-2124)
According to the versions of the unbound package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in unbound. An out-of-bounds write in the rdatacopy function may be abused by a remote attacker. The...
SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2021:2202-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2202-1 advisory. The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...
Debian DLA-2692-1 : bluez - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2692 advisory. Two issues have been found in bluez, a package with Bluetooth tools and daemons. One issue is about a man- in-the-middle attack during secure pairing, the other is...
Debian: Security Advisory (DLA-2692-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python urllib3
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python urllib3. Vulnerability Details CVEID: CVE-2021-28363 DESCRIPTION: urllib3 for python is vulnerable to a man-in-the-middle attack, caused by improper certificate validation in some cases involving HTTPS...
MGASA-2021-0281 Updated bluez packages fix security vulnerability
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing in the Passkey authentication procedure by reflection of the public key and the authentication evidence of the initiati...
Receita Federal IRPF Licensing Issue Vulnerability
Receita Federal Imposto de Renda Pessoa FĆsica, a personal income tax application from Receita Federal, Inc. has an authorization problem vulnerability in Receita Federal IRPF that stems from a lack of authentication measures or insufficient authentication strength in the network system or produc...
CVE-2021-34682
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...
Design/Logic Flaw
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...
CVE-2021-34682
CVE-2021-34682 refers to the Receita Federal IRPF 2021 v1.7, where the update feature is susceptible to a man-in-the-middle attack due to a lack of proper authentication. The vulnerability concerns the update mechanism itself and is described consistently across multiple sources (NVD/CNVD/Red Hat...
CVE-2021-34682: Undefined Security Weakness
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...
SUSE: Security Advisory (SUSE-SU-2019:2067-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-21559
Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client NetWorker Management Console components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated...
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-1962)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-1962)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way libcurl handled TLS 1.3 session tickets. A malicious HTTPS proxy could possibly use this flaw to make...
CVE-2020-17514
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful...
Code injection
Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the middle attack could be successful...
CVE-2020-17514
Apache Fineract up to version 1.5.0 disables HTTPS hostname verification in ProcessorHelper.configureClient, enabling potential MITM if hostname checks are not performed. This affects the client-communication security path and is documented across multiple sources (e.g., RH security pages and CVE...