PT-2025-49167

Name of the Vulnerable Software and Affected Versions WatchGuard Mobile VPN with SSL Client versions 12.0 through 12.11.2 Description A locally authenticated, non-administrative Windows user can elevate their privileges to NT AUTHORITY/SYSTEM on a Windows machine where the VPN Client is installed...

CVE-2024-56733

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

CVE-2023-20042

A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an...

CVE-2023-20031

A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a logic error that occurs whe...

ABB多款产品 信任管理问题漏洞

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

The vulnerability of the Platform V Pangolin DB database management system, related to data conflicts in BIO structures of OpenSSL, allows attackers to overwrite critical data, limit the ability to establish SSL connections, and cause data leaks from the process’s memory.

The vulnerability of the Platform V Pangolin DB database management system is related to a data conflict in the BIO structures of OpenSSL. Exploiting this vulnerability can allow an attacker to overwrite critical data, limit the ability to establish SSL connections, and cause data leaks from the...

io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

A flaw was found in Netty's SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation...

The vulnerability of the multi-platform SCADA system KROON-TM, related to the use of a rigidly encrypted cryptographic key for the SSL certificate, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the multi-platform SCADA system KROON-TM is related to the use of a rigidly encrypted cryptographic key for the SSL certificate. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-42177

HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system...

HCL MyXalytics 安全漏洞

HCL MyXalytics is an analytics software product from HCL India. It is used to perform data analysis and other related tasks. A security vulnerability exists in HCL MyXalytics, which stems from a BREACH and LUCKY13 vulnerability in the SSL/TLS protocol that could lead to data decryption or malicio...

io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

A flaw was found in Netty's SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation...

The vulnerability of the Netty network programming framework lies in improper validation of input data, which allows attackers to trigger service failures.

The vulnerability of the Netty network programming framework is related to insufficient validation of the data entered by the user in the SslHandler when using the own SSLEngine. Exploiting this vulnerability can allow a malicious actor to cause service failures...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX versions 7.2 and 7.3, which stems from improper control of the nimsh service SSL/TLS protection mechanism process an...

Asio C++ Library lacks a fallback error code in the case of SSL_ERROR_SYSCALL

...

The vulnerability of the implementations of TLS and SSL protocols in the B&R Automation Runtime and B&R mapp View software for managing and controlling industrial processes allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the TLS and SSL protocol implementations in B&R Automation Runtime and B&R mapp View software for process control and management involves the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to compromis...

RHEL 9 : openssl (RHSA-2025:1330)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1330 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Improper Validation of Specified Quantity in Input

Overview io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which...

GNU Transport Layer Security Library 3.8.9

GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...

CVE-2025-21087

When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Medium: python

Issue Overview: CPython 3.9 and earlier doesn't disallow configuring an empty list for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due ...