1129 matches found
PT-2023-18851 · Selfwealth · Selfwealth Ios Mobile App
Name of the Vulnerable Software and Affected Versions: Selfwealth iOS mobile App version 3.3.1 Description: The issue concerns Insecure App Transport Security ATS Settings in the Selfwealth iOS mobile App. This means the app may not properly secure its communication, potentially allowing for...
CVE-2023-23131
Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security ATS Settings...
CVE-2023-23131
Selfwealth iOS mobile App version 3.3.1 is identified as vulnerable due to Insecure App Transport Security (ATS) Settings. The root cause is improper ATS configuration allowing insecure network communication, which could impact confidentiality. AvailableConnected sources (NVD/Red Hat/PRION/CNNVD-...
Last Yard 安全漏洞
Last Yard is a shelf-edge promotional platform from Last Yard Australia. A security vulnerability exists in Last Yard version 22.09.8-1 that stems from its non-mandatory HSTS headers...
CVE-2023-23131
Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security ATS Settings...
PT-2023-15466 · Last Yard · Last Yard
Name of the Vulnerable Software and Affected Versions: Last Yard version 22.09.8-1 Description: The issue is related to the lack of enforcement of HSTS headers. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue...
Man-in-the-Middle (MitM)
openshift is vulnerable to Man-in-the-Middle MitM. The vulnerability exists because the library does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...
golang: crypto/tls: session tickets lack random ticket_age_add
A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...
Security Bulletin: IBM Cloud Pak for Security (CP4S) is vulnerable to information disclosure (CVE-2021-39090)
Summary IBM Cloud Pak for Security CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in t...
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...
OpenShift: Missing HTTP Strict Transport Security
Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update
Red Hat OpenShift Container Platform release 4.12.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...
Oracle Database Server 安全漏洞
Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Oracle Database Server versions 19c and 21c. An...
ALPINE-CVE-2022-43551
A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...
DEBIAN-CVE-2022-43551
A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...
CVE-2022-29910
When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 100...
curl 安全漏洞
Curl is a tool used to transfer data from or to a server. There is a security vulnerability in curl that stems from an HSTS check being bypassed to trick it into continuing to use HTTP. an attacker exploiting this vulnerability could access the data on curl to read sensitive information...