Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

4681 matches found

Prion
Prion•added 2021/04/01 6:15 p.m.•32 views

Design/Logic Flaw

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

4.3CVSS4.8AI score0.03141EPSS
SaveExploits1References9Affected Software6
Vulnrichment
Vulnrichment•added 2021/04/01 5:46 p.m.•1 views

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

5.3AI score0.03141EPSS
SaveExploits1References9
Cvelist
Cvelist•added 2021/04/01 5:46 p.m.•39 views

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

5.4AI score0.03141EPSS
SaveExploits1References9
CVE
CVE•added 2021/04/01 5:46 p.m.•401 views

CVE-2021-22890

CVE-2021-22890 affects curl 7.63.0 through 7.75.0. When using TLS 1.3 with an HTTPS proxy, libcurl could confuse TLS session tickets from the proxy as if they came from the remote server, potentially causing the host’s session ticket to be resumed incorrectly and bypass server certificate checks,...

4.3CVSS4.9AI score0.03141EPSS
SaveExploits1References9Affected Software1
AlpineLinux
AlpineLinux•added 2021/04/01 5:46 p.m.•127 views

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

4.3CVSS5.3AI score0.03141EPSS
SaveExploits1
Debian CVE
Debian CVE•added 2021/04/01 5:46 p.m.•54 views

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

4.3CVSS6.2AI score0.03141EPSS
SaveExploits1
OSV
OSV•added 2021/03/31 8:00 a.m.•13 views

CURL-CVE-2021-22890 TLS 1.3 session ticket proxy host mix-up

Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using an HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote serve...

4.3CVSS5.5AI score0.03141EPSS
SaveExploits1
OSV
OSV•added 2021/03/31 6:00 a.m.•15 views

UBUNTU-CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

4.3CVSS6.7AI score0.03141EPSS
SaveExploits1References4
UbuntuCve
UbuntuCve•added 2021/03/31 6:00 a.m.•38 views

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

4.3CVSS6.7AI score0.03141EPSS
SaveExploits1References3
FreeBSD
FreeBSD•added 2021/03/31 12:00 a.m.•39 views

curl -- TLS 1.3 session ticket proxy host mixup

Daniel Stenberg reports: Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arriv...

4.3CVSS5.8AI score0.03141EPSS
SaveExploits1References1
CVE
CVE•added 2021/03/29 7:36 p.m.•72 views

CVE-2020-35138

CVE-2020-35138 affects MobileIron agents for Android and iOS (up to 2021-03-22). The concrete issue is a hardcoded encryption key located in com/mobileiron/common/utils/C4928m.java, used to encrypt username/password submissions during authentication. Reported impact centers on credential handling...

9.8CVSS8.9AI score0.01186EPSS
SaveExploits1References5Affected Software1
NVD
NVD•added 2021/03/26 10:15 p.m.•54 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS0.01044EPSS
SaveExploits1References4
OSV
OSV•added 2021/03/26 10:15 p.m.•22 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

5.9CVSS7AI score
SaveExploits0References3
OSV
OSV•added 2021/03/26 10:15 p.m.•23 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.1AI score
SaveExploits0References4
NVD
NVD•added 2021/03/26 10:15 p.m.•28 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS0.01155EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB•added 2021/03/26 10:15 p.m.•7 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS6.8AI score0.01155EPSS
SaveExploits1References4Affected Software1
OSV
OSV•added 2021/03/26 10:15 p.m.•26 views

UBUNTU-CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.3AI score0.01044EPSS
SaveExploits1References3
UbuntuCve
UbuntuCve•added 2021/03/26 10:15 p.m.•20 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS6.8AI score0.01155EPSS
SaveExploits1References2
Prion
Prion•added 2021/03/26 10:15 p.m.•31 views

Remote code execution

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

6.8CVSS8.2AI score0.01044EPSS
SaveExploits1References4Affected Software1
Prion
Prion•added 2021/03/26 10:15 p.m.•22 views

Remote code execution

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

4.3CVSS6.2AI score0.01155EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder