libgd 信任管理问题漏洞

libgd is an open source library for dynamically creating images that supports the creation of charts, graphs, thumbnails, etc. by Thomas Boutell, an individual developer in the United States. A trust management issue vulnerability exists in libgd, which stems from the fact that in GNOME libgda...

OESA-2021-1321 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: curl supports the -t command line option, known as CURLOPTTELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pai...

Icinga 信任管理问题漏洞

Icinga is a scalable server, network resource monitoring system from Icinga, Germany. Icinga suffers from a trust management issue vulnerability that stems from instances of the application connecting to any of the mentioned time-series databases via spoofable infrastructure using TLS...

californium-core: DTLS - DoS vulnerability for certificate based handshakes

A flaw was found in californium. The certificate based x509 and RPK DTLS handshakes fails due to the DTLS server side being set to a wrong internal state by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The highest threat from this vulnerability is to system...

CVE-2020-29548

An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session...

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`) a malicious user can create a file name with the same name as the app wants to use by name and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

...

Smartertools SmarterTools SmarterMail 命令注入漏洞

Smartertools SmarterTools SmarterMail is a set of mail server software from SmarterTools Smartertools, USA. The program supports spam filtering, statistics, simple mail transfer protocol SMTP authentication and other features. SmarterTools SmarterMail suffers from a security vulnerability that...

CVE-2021-32069

The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data...

CVE-2021-32069

The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data...

Mitel Networks MiCollab 信任管理问题漏洞

Mitel Networks MiCollab is a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees.A security vulnerability exists in versions of Mitel Networks MiCollab prior to 9.3, which stems from a component that could be...

Mitel Networks MiCollab 安全漏洞

Mitel MiCollab is an enterprise collaboration software and tools platform solution. A man-in-the-middle attack vulnerability exists in the AWV and MiCollab Client Service components in Mitel MiCollab versions prior to 9.3. The vulnerability stems from insufficient control over TLS sessions. An...

CVE-2020-36363

Amazon AWS CloudFront TLSv1.22019 allows TLSECDHERSAWITHAES128CBCSHA256 and TLSECDHERSAWITHAES256CBCSHA384, which some entities consider to be weak ciphers...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-2290)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used ...

ZTE ZXCTN Authentication Bypass Vulnerability

ZTE ZXCTN is a packet transport product for the access layer of the bearer network of China ZTE ZTE. An authentication bypass vulnerability exists in ZTE ZXCTN 6120H version 5.10.00B24. The vulnerability is due to insufficient verification of data reliability by the system, which can be exploited...

The vulnerability in the implementation of the HSTS (HTTP Strict Transport Security) mechanism in Mozilla Firefox allows a perpetrator to circumvent these security measures.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism implemented by Mozilla Firefox is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to bypass security measures remotely...

CVE-2021-32003

Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used after provisioning. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...

CVE-2021-22926

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...