CVE-2024-47174 Credential leak when credentials are used with `<nix/fetchurl.nix>`

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle MITM...

CVE-2024-47174 Credential leak when credentials are used with `<nix/fetchurl.nix>`

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle MITM...

Nix 授权问题漏洞

Nix is a powerful package manager from the Nix open source. It is used for making packages. An authorization issue vulnerability exists in Nix from version 1.11 until version 2.24.8, which stems from the fact that nix/fetchurl.nix does not validate TLS certificates on HTTPS requests, resulting in...

Insecure HTTPS Connections

nategood/httpful is vulnerable to Insecure HTTPS Connections. The vulnerability is due to the lack of built-in certificate validation mechanisms in the Httpful library, which fails to enforce the proper verification of SSL/TLS certificates by default. It allows attackers to intercept and manipula...

NewStart CGSL MAIN 6.02 : perl-HTTP-Tiny Multiple Vulnerabilities (NS-SA-2024-0058)

The remote NewStart CGSL host, running version MAIN 6.02, has perl-HTTP-Tiny packages installed that are affected by multiple vulnerabilities: - It was found that perl can load modules from the current directory if not found in the module directories, via the @INC path. A local, authenticated...

CVE-2024-7346

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to b...

CVE-2024-7346 Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to b...

CVE-2024-37311 Collabora Online's remote host TLS certificates are not fully verified

Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora...

CVE-2024-37311

CVE-2024-37311 affects Collabora Online. In affected versions, https connections from coolwsd to other hosts may incompletely verify the remote host’s certificate against the full chain of trust. The issue is fixed in Collabora Online versions 24.04.4.3, 23.05.14.1, and 22.05.23.1. Related source...

CVE-2024-5445

Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...

CVE-2024-5445 Ecosystem Agent Insufficient Transport Layer Security

Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...

USN-6948-1: Salt vulnerabilities

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. CVE-2020-16846 It was discovered that Salt incorrectly created certificates with weak file permissions. CVE-2020-17490 It was discovered that Salt...

Ubuntu 16.04 LTS / 18.04 LTS : Salt vulnerabilities (USN-6948-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6948-1 advisory. It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary...

CVE-2024-32865 exacqVison - TLS certificate validation

Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices...

DigiCert Certificate Revocations

Update 9:00 a.m., EDT, July 31, 2024: DigiCert has provided updated information and revocation timelines which can be found by visiting: https://status.digicert.com/link is external CISA encourages customers to contact DigiCert if unable to reissue/rekey certificates by the updated revocation...

On Entrust? Imperva has your back!

Managing SSL/TLS certificates is a critical yet complex task for any organization. Certificates ensure secure communication between users and your web applications, but maintaining them involves constant vigilance and expertise. From monitoring expiration dates to renewing and deploying new...

Mageia: Security Advisory (MGASA-2024-0268)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated libreoffice packages fix security vulnerability

TLS certificates are not properly verified when utilizing LibreOfficeKit. CVE-2024-5261...

How to Detect Issuer Certificates and Comply with Google Chrome’s New Entrust Certificate Policy Using Qualys Certificate View

Google has announced that Chrome 127 and higher will no longer trust certain TLS certificates issued by Entrust, effective November 1, 2024. This change is significant and could potentially disrupt businesses relying on Entrust-issued certificates. Google stated that "publicly disclosed incident...

ROS-20240702-04

A vulnerability in the DecodeConfig component of the Golang programming language is related to the possibility that certain characters in the subject alternative name fields in TLS certificates are mistakenly allowed to have a special value in regular expressions. value in regular expressions...