493 matches found
JLSEC-2025-213 An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS)
An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...
JLSEC-2025-200 Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by...
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information an RSA private key by measuring cache usage during an import...
GNU Transport Layer Security Library 3.8.11
GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...
CVE-2025-59114
Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send malicious file to the server. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixe...
CVE-2025-48593
In btahfclientcbinit of btahfclientmain.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service [CVE-2025-8885], [CVE-2025-8916]
Summary Bouncycastle bcprov is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service. This bulletin provides patch information to address the reported...
CVE-2025-48813
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally...
EUVD-2011-1430
Malware in sbrugna...
EUVD-2021-2752
Malicious code in bioql PyPI...
EUVD-2021-2750
Malicious code in bioql PyPI...
EUVD-2021-2753
Malicious code in bioql PyPI...
EUVD-2021-2751
Malicious code in bioql PyPI...
The vulnerability of the GSS-NTLMSSP plugin of the GSSAPI library, which allows a hacker to trigger a service failure
The vulnerability of the GSS-NTLMSSP plugin of the GSSAPI library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...
The vulnerability of the GSS-NTLMSSP plugin of the GSSAPI library, which allows a hacker to trigger a service failure
The vulnerability of the GSS-NTLMSSP plugin of the GSSAPI library is related to the lack of memory release after the effective lifespan. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
CVE-2025-9231
A timing side-channel exists in the SM2 algorithm implementation of OpenSSL on 64-bit ARM platforms . This flaw in SM2 signature computations could allow an attacker to remotely recover the private key . While OpenSSL does not natively support SM2 certificates in TLS, the risk is considered Moder...
CVE-2025-48538
In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitatio...
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
...
CLSA-2025-1756961235 nss: Fix of CVE-2023-5388
CVE-2023-5388: fix timing attack against RSA decryption in TLS r=jschanck...
An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.
...
