294 matches found
Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates
Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.10 LTS and 12.10.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...
Azure Linux 3.0 Security Update: cloud-hypervisor-cvm / openssl (CVE-2024-12797)
The version of cloud-hypervisor-cvm / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12797 advisory. - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server M...
GHSA-M3PM-RPGG-5WJ6 Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
Summary Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. Details In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...
CVE-2025-25305
Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...
CVE-2025-25305 SSL validation for outgoing requests in Home Assistant Core and used libs not correct
Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...
Fedora 41 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2025-66ebd291f8)
The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-66ebd291f8 advisory. Changes with nginx 1.26.3 05 Feb 2025 Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different...
FreeBSD : OpenSSL -- Man-in-the-Middle vulnerability (a64761a1-e895-11ef-873e-8447094a420f)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a64761a1-e895-11ef-873e-8447094a420f advisory. The OpenSSL project reports: RFC7250 handshakes with unauthenticated servers don't abort as expected...
SUSE-SU-2025:20034-1 Security update for python-requests
This update for python-requests fixes the following issues: - Update to 2.32.2 To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed getconnection to a new public API, getconnectionwithtlscontext. Existing custom HTTPAdapters will need to...
CVE-2024-56521
An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely...
CVE-2024-56521
An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely...
Exploit for Missing Authentication for Critical Function in Really-Simple-Plugins Really_Simple_Security
POC for CVE-2024-10924 An error handling flaw in the REST API...
CVE-2024-32928
The libcurl CURLOPTSSLVERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through...
SUSE CVE-2024-35195
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verif...
Exploit for SQL Injection in Valvepress Automatic
CVE-2024-27956-RCE File Package Contents: 1. exploit.py...
The vulnerability of the Jenkins VMware Lab Manager Slaves Plugin involves disabling the global use of SSL/TLS protocols and verifying the authenticity of the host name for the virtual machine (JVM). This allows an attacker to execute a “man-in-the-middle” attack.
The vulnerability of the Jenkins VMware Lab Manager Slaves Plugin relates to the disabling of global use of SSL/TLS protocols and identity verification for virtual machine JVM hosts. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...
OPENSUSE-SU-2023:0223-1 Security update for perl-HTTP-Tiny
This update for perl-HTTP-Tiny fixes the following issues: perl-HTTP-Tiny was updated to 0.086: see /usr/share/doc/packages/perl-HTTP-Tiny/Changes 0.086 2023-06-22 10:06:37-04:00 America/NewYork - Fix code to use $ENVPERLHTTPTINYSSLINSECUREBYDEFAULT as documented. 0.084 2023-06-14 06:35:01-04:00...
CLSA-2023-1689700589 Fix CVE(s): CVE-2023-31486
SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module - debian/patches/CVE-2023-31486.patch: add verifySSL=1 to HTTP::Tiny default configuration - CVE-2023-31486...
CLSA-2023-1686859226 perl: Fix of CVE-2023-31484
CVE-2023-31484: fix possible MITM attach due to missing SSL verification...