Google Nest 安全漏洞

Google Nest is a smart home product from the American company Google Google. Google Nest suffers from a trust management issue vulnerability that stems from the application failing to properly validate the server certificate when initializing a TLS connection, which can be exploited by a cyber...

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

RLSA-2024:6783 Moderate: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Possible denial of service in X.509 name checks CVE-2024-6119 For more details about the security...

The vulnerability in the CODESYS web server environment allows a attacker to cause a service failure.

The vulnerability in the CODESYS web server’s execution environment related to CODESYS Control is due to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures by sending a specially crafte...

golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to...

The vulnerability of the NBD library protocol, related to incorrect certificate verification, allows attackers to disclose protected information and compromise the integrity of the system.

The vulnerability of the NBD protocol of the libnbd library is related to improper verification of the NBD server’s certificate when TLS is used for connecting to the NBD server. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and compromise the integri...

Apache Tomcat 安全漏洞

Apache Tomcat is a lightweight Web application server from the American Apache Apache Foundation. It is used to implement support for Servlets and JavaServer Page JSP. A security vulnerability exists in Apache Tomcat that stems from allowing an attacker to cause an out-of-memory error by abusing...

libnbd: NBD server improper certificate validation

A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic...

The vulnerability in the TLS protocol implementation of the Firefox web browser relates to errors in the certificate validation process, which allows attackers to compromise data integrity.

The vulnerability in the implementation of the TLS protocol in the Firefox web browser is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

The vulnerability of the SSLSelect_next_proto function in TLS and SSL OpenSSL protocols relates to information disclosure, which allows attackers to access confidential data and cause service failures.

The vulnerability of the SSLSelectnextproto function in TLS and SSL OpenSSL relates to the disclosure of information. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and also cause service failures...

SUSE CVE-2024-45159

An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtlssslgetverifyresult would...

CVE-2024-40714

An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations...

ALPINE-CVE-2024-45159

An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtlssslgetverifyresult would...

PT-2024-31443 · Mbed Tls +1 · Mbed Tls +1

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.x before 3.6.1 Description: An issue was discovered in Mbed TLS with TLS 1.3, when a server enables optional authentication of the client. If the client-provided certificate does not have appropriate values in keyUsage or...

golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to...

golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to...

golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to...

Progress Software OpenEdge 安全漏洞

Progress Software OpenEdge is a suite of integrated development environments IDEs from Progress Software, USA. A security vulnerability exists in Progress Software OpenEdge that originates from a hostname validation that allows bypassing TLS certificates...

PT-2024-38914 · Unknown · Kroxylicious

Name of the Vulnerable Software and Affected Versions: Kroxylicious affected versions not specified Description: A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's...

SUSE CVE-2024-5814

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello...