F5 BIG-IP和F5 SSL Orchestrator 缓冲区错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A memory corruption vulnerability exists in the Explicit Forward Proxy module of the BIG-IP SSL Orchestrator. The vulnerabilit...

F5 BIG-IP 缓冲区错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A denial of service vulnerability exists in the SSL/TLS module of BIG-IP. The vulnerability arises because when the...

F5 Networks BIG-IP : BIG-IP SSL Orchestrator vulnerability (K000151368)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6 / 17.1.3. It is, therefore, affected by a vulnerability as referenced in the K000151368 advisory. When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy conne...

F5 BIG-IP和F5 SSL Orchestrator 安全漏洞

F5 BIG-IP and F5 SSL Orchestrator are both products of F5 Corporation, USA. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 SSL Orchestrator is an all-in-one appliance solution designed for SSL...

F5 Networks BIG-IP : BIG-IP SSL/TLS vulnerability (K000139514)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.2. It is, therefore, affected by a vulnerability as referenced in the K000139514 advisory. When Diffie-Hellman DH group Elliptic Curve Cryptography ECC Brainpool curves are configured in an SSL profile's Cipher Rule o...

Fortinet Fortigate Authenticated Heap Overflow in SSL-VPN bookmarks (FG-IR-25-756)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-25-756 advisory. - An Heap-based Buffer Overflow vulnerability CWE-122 in FortiOS version 7.6.2 and below, version 7.4.7 and below, version...

F5 Networks BIG-IP : BIG-IP SSL Orchestrator vulnerability (K000150667)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.4 / 17.1.3 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K000150667 advisory. When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel TM...

EUVD-2025-34237

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker e.g. a former admin whose account was removed and whose session was terminated in possessi...

CVE-2025-25252

This CVE (CVE-2025-25252) concerns an Insufficient Session Expiration (CWE-613) in FortiOS SSL VPN across multiple major releases, allowing a remote attacker with a valid SAML session record (e.g., a former admin) to access or reopen that session via re-use of the SAML record. A public POC exists...

CVE-2025-25252

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker e.g. a former admin whose account was removed and whose session was terminated in possessi...

Fortinet Fortigate FGFM protocol allows unauthenticated reset of the connection (FG-IR-24-041)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-041 advisory. - An improper check or handling of exceptional conditions vulnerability CWE-703 in FortiOS version 7.4.0 through 7.4.3 and...

PT-2025-41947

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.6.2 FortiOS versions 7.4.0 through 7.4.6 FortiOS versions 7.2.0 through 7.2.10 FortiOS versions 7.0.0 through 7.0.16 FortiOS version 6.4 Description An insufficient session expiration issue exists in FortiOS SS...

The vulnerability of the OpenSSL cryptographic library, related to the use of memory after it is freed, allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the OpenSSL cryptographic library is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial-of-service attack...

Fortinet Fortigate Insufficient Session Expiration in SSLVPN using SAML authentication (FG-IR-24-487)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-487 advisory. - An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL VPN 7.6.0 through 7.6.2... CVE-2025-25252 Note that...

Exploit for Server-Side Request Forgery in Apache Kafka

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Produc...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2025-2228)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-52632

A Missing Secure Attribute in Encrypted Session SSL Cookie vulnerability in HCL AION.This issue affects AION: 2.0...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing - Apache Commons HttpClient before 4.2.3 allows man-in-the-middle attack

Summary Apache Commons HttpClient before 4.2.3 allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Following IBM® Engineering Lifecycle Management product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Lifecycle...

RLSA-2025:15023 Moderate: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: insufficient escaping of user-supplied data in modssl CVE-2024-47252 httpd: modssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption...

httpd security update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...