Multiple NETGEAR Products Trust Management Issue Vulnerabilities

The NETGEAR R8900, among others, is a wireless router from NETGEAR. A security vulnerability exists in several NETGEAR products. The vulnerability can be exploited by an attacker to obtain the private key of a Transport Layer Security TLS certificate...

CVE-2019-4594

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID:...

Information disclosure

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID:...

CVE-2019-4594

IBM QRadar SIEM is affected by CVE-2019-4594. Affected versions are QRadar 7.3.0 to 7.3.3 Patch 2; the root cause is failure to properly enable HTTP Strict Transport Security, enabling a remote attacker to obtain sensitive information through man-in-the-middle techniques. Impact is information di...

CVE-2019-4594

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-ForceID:...

Security Bulletin: IBM QRadar SIEM is vulnerable to information exposure (CVE-2019-4594)

Summary IBM QRadar could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Vulnerability Details CVEID: CVE-2019-4594 DESCRIPTION: IBM QRadar could allow a remote attacker to obtain sensitive information, caused by the...

mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure.

A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive...

urban-transport-magazine.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1140830 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Denial Of Service (DoS)

The kernel packages is vulnerable to Denial of Service DoS. Due to a flaw found in the Unidirectional Lightweight Encapsulation ULE implementation, a remote attacker could send a specially-crafted ISO MPEG-2 Transport Stream TS frame to a target system, resulting in an infinite loop...

An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1

An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1 Summary What is DTLS? The DTLS protocol provides communications privacy. The protocol allows client and server applications to communicate in a way that is designed to prevent eavesdropping, tamperin...

An update that enables Internet Explorer in Windows Vista or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available

An update that enables Internet Explorer in Windows Vista or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available Warning: The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain...

Update Rollup 14 for System Center 2012 R2 Operations Manager

Update Rollup 14 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 14 for Microsoft System Center 2012 R2 Operations Manager. This article also contains the installation instructions for this update. Issues that are fixed...

UBUNTU-CVE-2020-11653

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss...

PT-2020-12751 · Varnish +6 · Varnish Cache +6

Name of the Vulnerable Software and Affected Versions: Varnish Cache versions prior to 6.0.6 LTS Varnish Cache versions 6.1.x Varnish Cache versions 6.2.x prior to 6.2.3 Varnish Cache versions 6.3.x prior to 6.3.2 Description: An issue occurs in Varnish Cache when communication with a TLS...

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application compiled with nss. While the attack complexi...

CVE-2020-5860

On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability HA network failover in Device Service Cluster DSC, the failover service does not require a strong form of authentication and HA...

wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure.

A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive...

mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure.

A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive...