The vulnerability of the Java Secure Socket Extension (JSSE) component of the OpenJDK project, a programming language for Java, allows attackers to gain access to confidential data.

The vulnerability of the Java Secure Socket Extension JSSE component of the OpenJDK project, a programming language, is related to errors in processing the attached OCSP response during TLS handshake. Exploiting this vulnerability can allow an attacker operating remotely to gain access to...

October 15, 2019—KB4520012 (Preview of Monthly Rollup)

None None...

October 15, 2019—KB4520015 (Preview of Monthly Rollup)

None None...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

Microsoft Windows Transport Layer Security Spoofing Vulnerability

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. To exploit the vulnerability, an attacker would have to conduct a...

KB4519998: Windows 10 Version 1607 and Windows Server 2016 October 2019 Security Update

The remote Windows host is missing security update 4519998. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user...

KB4520004: Windows 10 Version 1709 October 2019 Security Update

The remote Windows host is missing security update 4520004. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. CVE-2019-1340 - A spoofing vulnerability exists...

KB4520011: Windows 10 October 2019 Security Update

The remote Windows host is missing security update 4520011. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge HTML-based. The vulnerability could corrupt...

KB4517389: Windows 10 Version 1903 October 2019 Security Update

The remote Windows host is missing security update 4517389. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. CVE-2019-1340 - A spoofing vulnerability exists...

The vulnerability of the TLS protocol implementation in the software platform of IOx network devices from Cisco Systems Inc. allows a attacker to cause a service failure.

The vulnerability of the TLS protocol implementation in the IOx software platform of Cisco Systems Inc. exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted TLS packets to the IOx web...

CVE-2019-6652

In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security TLS...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

PT-2019-18234 · F5 · F5 Big-Iq

Name of the Vulnerable Software and Affected Versions: F5 BIG-IQ versions 6.0.0 through 6.1.0 Description: The issue concerns a lack of authentication and Transport Layer Security TLS in services for statistics. This means that these services can be accessed without proper verification and...

DEBIAN-CVE-2019-15699

An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 TLS 1.2 packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of t...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...