CVE-2021-34080

CVE-2021-34080 describes an OS Command Injection in es128 ssl-utils 1.0.0 for Node.js, where unsanitized shell metacharacters supplied to createCertRequest() and createCert() enable arbitrary command execution. The provided connected documents (Red Hat, Veracode, GitHub advisory GHSA-552J-PV39-F3...

Security Bulletin: Vulnerability in IBM Java SDK affect IMS™ Enterprise Suite: SOAP Gateway, Connect API for Java, Explorer for Development (CVE-2015-4872).

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.1.10 and earlier that is used by IMS™ Enterprise Suite: SOAP Gateway, Connect API for Java, Explorer for Development. This issue was disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Detai...

Security Bulletin: Vulnerability in RC4 stream cipher affects IMS™ Enterprise Suite: Connect API for Java, SOAP Gateway, and Explorer for Development (CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, IBM SDK, Java Technology Edition, Version 7 Service Refresh 8 that is used the following IMS™ Enterprise Suite components: Connect API for Java, SOAP Gateway, and Explorer for Development. This bulletin also addresse...

Important: Red Hat Security Advisory: rsyslog and rsyslog7 security update

An update for rsyslog and rsyslog7 is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Vulnerability in OpenSSL (CVE-2022-0778) affects Power HMC

Summary OpenSSL is used by IBM Power Hardware Management Console HMC for cryptography toolkit implementing the Secure Sockets Layer SSL and Transport Layer Security TLS network protocols and related cryptography standards required by them. This bulletin provides a remediation for the impacted...

Fortinet FortiOS Access Control (FG-IR-21-147)

An improper access control vulnerability in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands. Note that Nessus has...

The vulnerability in the implementation of the CURLOPT_CERTINFO option for SSL certificates in the cURL command-line utility allows a attacker to cause a service failure.

The vulnerability in the implementation of the CURLOPTCERTINFO option for SSL certificates in the cURL command-line utility is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Slackware: Security Advisory (SSA:2022-146-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the encryption algorithm implementation according to GOST 34.12 in the CTR_OMAC library, which is used in the implementation of the OpenSSL protocol, allows a perpetrator to trigger buffer overflows, provided that the server uses 512-bit secret keys.

The vulnerability of the encryption algorithm implementation according to GOST 34.12 for the CTROMAC library, used in the implementation of the OpenSSL protocol, is related to errors in processing the encryption key for the BLOB object a large binary object in the...

Fedora: Security Advisory for curl (FEDORA-2022-8277bef335)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Huawei EulerOS: Security Advisory for postgresql (EulerOS-SA-2022-1756)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Certificate Validation in Apache Netbeans

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are...

GHSA-7C2M-VWXW-5QWW Improper Certificate Validation in Apache Netbeans

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are...

kevinsawicki/http-request Missing certificate validation

OSS Http Request kevinsawicki/http-request is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

GHSA-Q296-9J5X-FXF4 SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers. Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by...

SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers. Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by...

SaltStack Salt Improper SSL Certificate Validation

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...

GHSA-W589-R335-4F55 SaltStack Salt Improper Certificate Validation

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

GHSA-QX72-Q6W3-QGC7 SaltStack Salt Improper SSL Certificate Validation

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...

SaltStack Salt Improper Certificate Validation

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...