CVE-2023-0897

CVE-2023-0897 affects Sielco PolyEco1000 family (PolyEco1000 CPU:2.0.6/1.9.4/1.9.3; PolyEco500 1.7.0; PolyEco300 2.0.2/2.0.0) with a session hijack/session fixation risk due to cookies susceptible to brute-force, no SSL, and visible session data in requests. NVD CVSSv3.1 base score 9.8 (CRITICAL)...

CVE-2023-0897 Session FIxation in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

com.floragunn:search-guard-2 (>=5.0.0-rc1-6a, <=5.0.0-rc1-6d), com.floragunn:search-guard-ssl (>=5.0.0-rc1-16c, <=5.0.0-rc1-16d) +11 more potentially affected by CVE-2023-31418 via org.elasticsearch:elasticsearch (5.0.0-rc1)

org.elasticsearch:elasticsearch MAVEN version 5.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.floragunn:search-guard-2 =5.0.0-rc1-6a, =5.0.0-rc1-16c, =5.0.0-rc1-16d -...

CLSA-2023-1698312967 perl: Fix of CVE-2023-31484

CVE-2023-31484: add verifySSL=1 to HTTP::Tiny to verify https server identity...

[SECURITY] Fedora 37 Update: mbedtls-2.28.5-1.fc37

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

CVE-2023-0897: Session Fixation

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

USN-6435-2: OpenSSL vulnerabilities

USN-6435-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could possibly use this issue to cause a denial ...

BIG-IP Access Policy Manager Vulnerable Information Exposure

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

BIG-IP Memory Leak DoS

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

BIG-IP Session Duration Issue

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

Citrix ADC (NetScaler) Bleed Scanner

This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory for a target Citrix ADC server. The leaked memory is then scanned for session cookies which can be hijacked if found. Module Options msf use auxiliary/scanner/http/citrix/bleedcve20234966 msf...

CVE-2023-5748

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors...

CVE-2023-5748

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors...

CVE-2023-5748

CVE-2023-5748 affects Synology SSL VPN Client prior to 1.4.7-0687. A buffer copy without input size checking in the CGI component enables local users to cause a denial-of-service. Remediation: upgrade to 1.4.7-0687 or later. Other connected sources corroborate the CGI-based buffer overflow issue ...

PT-2023-32302 · Synology · Synology Ssl Vpn Client

Name of the Vulnerable Software and Affected Versions: Synology SSL VPN Client versions prior to 1.4.7-0687 Description: The issue is related to a buffer copy without checking the size of the input, which is a 'Classic Buffer Overflow' vulnerability in the cgi component. This allows local users t...

Citrix Gateway unable to connect to Citrix Endpoint Management Cloud server

Citrix Gateway unable to connect to Citrix Endpoint Management cloud server due to SSL certificate issue Symptoms include the below, STA shows down. Secure Hub fails in Enrollments Secure Hub fails to access store...

CVE-2023-5748: Buffer Copy without Checking Size of Input

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

Ubuntu 16.04 ESM : DBD::mysql vulnerabilities (USN-5344-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5344-1 advisory. It was discovered that the DBD::mysql module, when configured with server-side prepared statement support, was susceptible to operations that would resul...