1017 matches found
Sophos SSL VPN Code Execution
The vulnerability of SSL VPN configuration loading on Sophos firewalls lies in the possibility of code injection. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
erlang/otp: Client Authentication Bypass
A Client Authentication Bypass was found in Erlang/OTP. This issue occurs in certain client-certification situations for SSL, TLS, and DTLS...
Sophos Firewall operating system command injection vulnerability
Sophos Firewall is a firewall from Sophos UK. Sophos Firewall version 19.5GA suffers from an operating system command injection vulnerability that stems from the fact that an attacker can achieve command injection leading to code execution by an administrator via its SSL VPN configuration file...
PT-2022-5774 · Sophos · Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: The issue allows for OS command injection, enabling the execution of code via SSL VPN configuration uploads. This can be exploited by a remote attacker to execute arbitrary code...
Vulnerability fixed in Erlang OTP
Erlang developers have fixed a vulnerability in Erlang OTP. A malicious party could exploit the vulnerability to gain access to sensitive data, when using Erlang SSL in combination with client authentication. Erlang has released updates to fix the vulnerability in OTP 25.1; for more information,...
SSL/TLS certificate validation globally and unconditionally disabled by cavisson-ns-nd-integration
cavisson-ns-nd-integration 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. cavisson-ns-nd-integration 4.8.0.146 no longer disables SSL/TLS certificate and hostname validation globally...
October 18, 2022—KB5020440 (OS Build 10240.19509) Out-of-band
None None...
KB5020449: Out-of-band update for Windows Server 2012: October 17, 2022
KB5020449: Out-of-band update for Windows Server 2012: October 17, 2022 Summary This update includes improvements for the following: It addresses an issue that might affect some types of Secure Sockets Layer SSL and Transport Layer Security TLS connections. These connections might have handshake...
KB5020447: Out-of-band update for Windows 8.1 and Server 2012 R2: October 17, 2022
KB5020447: Out-of-band update for Windows 8.1 and Server 2012 R2: October 17, 2022 Summary This update includes improvements for the following: It addresses an issue that might affect some types of Secure Sockets Layer SSL and Transport Layer Security TLS connections. These connections might have...
October 17, 2022 Non-security update (KB5020446) Out-of-band
None None...
October 17, 2022—KB5020435 (OS Builds 19042.2132, 19043.2132, and 19044.2132) Out-of-band
None None...
October 17, 2022—KB5020387 (OS Build 22000.1100) Out-of-band
None None...
October 17, 2022—KB5020436 (OS Build 20348.1131) Out-of-band
None None...
DEBIAN-CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...
Ericsson Erlang Authorization Issue Vulnerability
Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...
ISC BIND security vulnerability
ISC BIND is a suite of open source software that implements the DNS protocol from the US company ISC. A security vulnerability in ISC BIND versions 9.18.x prior to 9.18.7 and 9.19.x prior to 9.19.5, which stems from changes between OpenSSL 1.x and OpenSSL 3.0 exposes a flaw in the naming, which c...
Tyler Odyssey Trust Management Vulnerability
Tyler Technologies Tyler Odyssey is a court and judicial software system from Tyler Technologies, USA. Tyler Odyssey suffers from a security vulnerability that stems from passing unencrypted bytes from an intermediary to a client An intermediary attacker can inject an incorrect response to the...
PT-2022-11907 · Odyssey · Odyssey
Name of the Vulnerable Software and Affected Versions: Odyssey affected versions not specified Description: The issue allows a man-in-the-middle attacker to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This...