Amazon Corretto Java 8.x < 8.372.07.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.372.07.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2023-Apr-18 advisory. - security-libs/javax.net.ssl CVE-2023-21930, CVE-2023-21967 - core-libs/java.net CVE-2023-21937 -...

AIX (IJ45224)

The version of AIX installed on the remote host is prior to APAR IJ45224. It is, therefore, affected by a vulnerability as referenced in the IJ45224 advisory. - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify tha...

The vulnerability of the OpenSSL cryptographic library, related to errors in the certificate validation process, allows a perpetrator to cause a service failure.

The vulnerability of the OpenSSL cryptographic library is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures using a specially created certificate chain...

Security Bulletin: Vulnerabilities affect IBM's Advanced Management Module (AMM)

Summary Multiple vulnerabilities affect IBM's Advance Management Module AMM. Vulnerability Details Abstract Multiple vulnerabilities affect IBM's Advance Management Module AMM. Content Vulnerability Details: CVE-ID: CVE-2014-2653 Description: OpenSSH could allow a remote attacker to bypass securi...

Security Bulletin: BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary URGENT: Security vulnerabilities have been discovered in OpenSSL Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL Content Vulnerability Details: CVE ID: CVE-2014-0160 Description: OpenSSL could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter S SAS RAID Module Firmware (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah Attack" for SSL/TLS affects IBM BladeCenter S SAS RAID Module Firmware. Vulnerability Details Summary The RC4 "Bar Mitzvah Attack" for SSL/TLS affects IBM BladeCenter S SAS RAID Module Firmware. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter Switches (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Switches. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Switches. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and S...

FreeBSD : py-slixmpp -- incomplete SSL certificate validation (93db4f92-9997-4f4f-8614-3963d9e2b0ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 93db4f92-9997-4f4f-8614-3963d9e2b0ec advisory. - Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to...

Security Bulletin: AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient (CVE-2012-5783)

Summary A vulnerability in Apache Commons HttpClient could allow a remote attacker to conduct spoofing attacks CVE-2012-5783. AIX ships Apache Commons HttpClient as part of Electronic Customer Care. Vulnerability Details CVEID:CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazo...

AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient

IBM SECURITY ADVISORY First Issued: Thu Apr 13 13:44:57 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/commonshttpadvisory.asc Security Bulletin: AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient...

Fortinet Fortigate Policy-based NGFW SSL VPN mode doesn't filter accesses via Bookmarks (FG-IR-22-381)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-381 advisory. - A permissive list of allowed inputs vulnerability CWE-183 in FortiGate version 7.2.3 and below, version 7.0.9 and below...

GHSA-R3MM-V4X7-2PHM Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server...

GHSA-38JC-2RWX-QGXR Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries. Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default...

Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server...

Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries. Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default...

CVE-2023-30516

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by defau...

CVE-2023-30517

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server...

Input validation

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server...

Default credentials

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by defau...

CVE-2023-30517

CVE-2023-30517 affects Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier. The root cause is that the plugin unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server, exposing clients to potential inte...