Citrix Receiver is Unable to Create a Secure (https://) Connection in the Browser

When launching applications on Internet Explorer 10 using the Citrix Receiver for HTML5 v1.1, the following error message appears: “Citrix Receiver cannot create a secure https:// connection in this browser. Please try a different browser.”...

CVE-2024-22064

CVE-2024-22064 affects ZTE ZXUN-ePDG, a network node for the VoWifi system. The vulnerability arises from by-default configuration that uses a set of non-unique cryptographic keys during establishing a secure IKE connection with mobile devices. If these keys are leaked or cracked, user session in...

LibOSDP vulnerable to a null pointer deref in osdp_reply_name

Issue: At ospdcommon.c, on the osdpreplyname function, any reply id between REPLYACK and REPLYXRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null name = namesreplyid - REPLYACK;. Null name will casue a crash on next...

GHSA-7945-5MCV-F2PP LibOSDP vulnerable to a null pointer deref in osdp_reply_name

Issue: At ospdcommon.c, on the osdpreplyname function, any reply id between REPLYACK and REPLYXRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null name = namesreplyid - REPLYACK;. Null name will casue a crash on next...

CVE-2024-1638

The documentation specifies that the BTGATTPERMREADLESC and BTGATTPERMWRITELESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when i...

Design/Logic Flaw

The documentation specifies that the BTGATTPERMREADLESC and BTGATTPERMWRITELESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when i...

CVE-2024-1638

CVE-2024-1638 concerns Bluetooth LE GATT permission checks in Zephyr and related disclosures. The issue is that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC flags are intended to require LE Secure Connections for read/write access, but only when used with additional permissions (BT_GATT...

CVE-2024-1638 Bluetooth characteristic LESC security requirement not enforced without additional flags

The documentation specifies that the BTGATTPERMREADLESC and BTGATTPERMWRITELESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when i...

Improper Certificate Validation

jruby-openssl is vulnerable to Improper Certificate Validation. The vulnerability is due to incorrect hashing of certificate names in X509Name.java and insufficient checking of certificate path lengths in StoreContext.java. This allows an attacker to trick the client application into believing th...

Prevent ICA downloads when initiating a hybrid launch

ICA files contain the information to connect to a resource so must be handled securely. In some situations when the user uses a web browser to launch into Citrix Workspace app installed locally hybrid launch, the browser downloads an .ica file rather than keeping it in-memory, which allows it to ...

CVE-2023-0897

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

How to access http://director/Citrix/Monitor/OData/v3 in HTTPS

Accessinghttp://director/Citrix/Monitor/OData/v3 in HTTPS...

Cloudflare Tunnel increasingly abused by cybercriminals

Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Cybercriminals are increasingly using this service to keep their activities from being detected. Cloudflare Tunnel, also known by its executable name, Cloudflared,...

Mozilla: Use-after-free in WebRTC certificate generation

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS...

curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

SUSE CVE-2020-15187

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform thi...

python-scciclient: missing server certificate verification

A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...

TLS Connection Cryptographic Protocol Vulnerabilities

TLS is the backbone of encryption and key to ensuring data integrity, but its misconfiguration can leave your system vulnerable. Read on to discover how to secure your TLS connection and arm your organization against malicious attacks...

CVE-2022-27535

Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker...

CVE-2022-27535

CVE-2022-27535 affects Kaspersky VPN Secure Connection for Windows up to version 21.5. A local authenticated attacker can abuse the app’s Delete All Service Data And Reports feature to perform arbitrary file deletion. Some sources describe potential privilege escalation via crafted symbolic links...