ALSA-2025:15095 Moderate: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: insufficient escaping of user-supplied data in modssl CVE-2024-47252 httpd: modssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption...

CVE-2025-33084

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-33084

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-33084 IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-33084

CVE-2025-33084 concerns IBM Concert Software versions 1.0.0–1.1.0 , where failure to enable HTTP Strict Transport Security (HSTS) can allow a remote attacker to obtain sensitive information via man‑in‑the‑middle techniques. The provided documents substantiate an information disclosure risk stemmi...

IBM Concert Software 加密问题漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. An encryption issue vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0 that stems from not properly enabling HTTP Strict Transport Security, which could...

PT-2025-35492

Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.1.0 Description: IBM Concert Software fails to properly enable HTTP Strict Transport Security HSTS, potentially allowing a remote attacker to obtain sensitive information. An attacker could exploi...

Linux Distros Unpatched Vulnerability : CVE-2025-38572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: reject malicious packets in ipv6gsosegment syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of...

Linux Distros Unpatched Vulnerability : CVE-2019-2435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/Python. Supported versions that are affected are 8.0.13 and prior and...

Linux Distros Unpatched Vulnerability : CVE-2018-10100

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. CVE-2018-10100 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2018-9860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving si...

Linux Distros Unpatched Vulnerability : CVE-2020-24613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation ...

Linux Distros Unpatched Vulnerability : CVE-2020-12457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in wolfSSL before 4.5.0. It mishandles the changecipherspec CCS message processing logic for TLS 1.3. If an attacker sends...

Remote Code Execution (RCE)

org.apache.cxf:cxf-rt-transports-jms is vulnerable to Remote Code Execution RCE. The vulnerability is due to allowing untrusted users to configure JMS with RMI or LDAP URLs, which could be abused for code execution...

SUSE CVE-2024-58240

In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We...

CVE-2025-31972

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components...

httpd: HTTP Session Hijack via a TLS upgrade

An HTTP session hijacking flaw was found in Apache httpd. In some modssl configurations on Apache HTTP Server, an HTTP desynchronization attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade...

CVE-2025-31972 HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components...

CVE-2025-31972 HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerability

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components...

CVE-2025-31972

CVE-2025-31972 affects HCL BigFix SM. It describes a sensitive information exposure due to internal connections not using TLS, allowing potential disclosure of data between internal components. CVSS 3.1 base score 6.5 (MEDIUM); attack vector adjacent, attack complexity low, privileges required no...