ibmsecurity

IBM 示例代码 此仓库包含用于通过各自 REST API 管理 IBM 安全设备的 Python 代码。 ISAM 设备的代码最为成熟。 ISDS 设备的代码正在开发中。 ISVG 设备的代码是全新的（仅针对 10.0.1.0 及更高版本测试过）。 要求 此软件包需要 Python v3.9 或更高版本。 以下 Python 软件包是必需的： 1. requests - 用于发起 REST API 调用 2. PyYAML - 用于示例代码的运行 3. jmespath - 示例代码所需 以下 Python 软件包是可选的： 1. cryptography - 用于对证书执行操作（用于...

CVE-2024-40898

CVE-2024-40898 此 Python 脚本用于检测 CVE-2024-40898，这是 Apache HTTP Server 中的一个严重漏洞，在某些错误配置下可能允许绕过 SSL/TLS 证书验证。它会向目标服务器发起 SSL 连接并发送一个 HEAD 请求。 脚本向目标服务器发起 SSL 连接并发送 HEAD 请求。如果响应表明 SSL 证书验证未正确处理，则服务器可能存在漏洞。 🚀 特性 ✅ 支持完整 URL 或纯 IP，可附带端口 ✅ 自动解析端口，未指定时默认使用 443 ✅ 忽略 SSL 证书错误（用于测试目的） ✅ 极简且快速的检测逻辑 ✅ 清晰的输出指示可能的漏...

CVE-2026-0073-Research

CVE-2026-0073-Research CVE-2026-0073 es un RCE con una puntuación de severidad CVSS de 8.3, y aquí explicaremos cómo funciona. Primera parte: Análisis del código: Al principio, lo único que podría ser interesante es aprender más sobre el propio fallo. Mi primera fuente es:...

CVE-2026-32794

CVE-2026-32794：Apache Airflow Databricks 提供程序中的 TLS 证书验证绕过 关键词： TLS、证书验证、MITM、Kubernetes、Databricks、OAuth、CWE-295、Apache Airflow 目录 概述 漏洞详情 技术分析 攻击链 影响 修复方案 时间线 参考资料 联系方式 免责声明 概述 apache-airflow-providers-databricks 包在与 Kubernetes API 服务器通信进行联合令牌交换时，禁用了 TLS 证书验证。同步和异步代码路径均使用 verify=False /...

gosign-desktop-exploit-poc

Múltiples vulnerabilidades en GoSign Desktop conducen a ejecución remota de código Nombre: Omisión de verificación TLS y actualización insegura en GoSign Desktop CVEs: CVE-2025-34324, CVE-2025-34327 Sistema afectado: GoSign Desktop = 2.4.0 Corrección: FoSign Desktop 2.4.1 corregido parcialmente...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_10550)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510550 advisory. podman: podman missing TLS verification CVE-2025-6032 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

php: php: Server impersonation via Common Name fallback in TLS verification

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

Security Bulletin: IBM Operator for Apache Flink is affected by Multiple Vulnerabilities

Summary IBM Operator for Apache Flink is affected by Multiple Vulnerabilities and was addressed in BM Operator for Apache Flink 1.5.5 Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname...

CVE-2026-84975 PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/sslsockossl.c and pjlib/src/pj/sslsockgtls.c copy DNS SubjectAltName values with string functions that recalculate their length and truncate an...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

EUVD-2026-78899

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...

CVE-2026-52724

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

EUVD-2026-78771

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724

Kuma is an Envoy-based service mesh. In Universal mode , when kuma-dp connects to an HTTPS control plane without a CA certificate (--ca-cert-file unset and KUMA_CONTROL_PLANE_CA_CERT unset), TLS peer verification is disabled . An on-path attacker can intercept the dataplane authentication token, ...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...