5363 matches found
PT-2025-7058
Name of the Vulnerable Software and Affected Versions: gh versions 2.49.0 through 2.66.x Description: A bug in GitHub's Artifact Attestation CLI tool, gh attestation verify, causes it to return a zero exit status when no attestations are present, under certain conditions. This behavior is...
CVE-2025-25204: Detection of Error Condition Without Action
gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...
GitHub CLI 安全漏洞
GitHub CLI is the GitHub CLI open source for GitHub on the command line. A security vulnerability exists in GitHub CLI versions prior to 2.49.0 through 2.67.0, which stems from the gh attestation verify tool returning an error in status, which could lead an attacker to deploy malicious artifacts...
SUSE CVE-2024-12797
Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...
requests: subsequent requests to the same host ignore cert verification
An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification...
AZL-56774 CVE-2024-12797 affecting package openssl for versions less than 3.3.3-1
Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...
AZL-78591 CVE-2024-12797 affecting package openssl-fips-provider 3.1.2-2
Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...
DEBIAN-CVE-2024-12797
Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfsreftreemod after we successfully inserted the new ref entry local variable 'ref' into the respective block entry's rbtree local variable 'be', if we find an...
Astra Linux – Vulnerability in gnutls28
A flaw has been discovered in GnuTLS, where an application crash can occur when attempting to verify a specially crafted .pem bundle using the “certtool --verify-chain” command...
CVE-2024-45658
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system...
CVE-2024-51450
IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...
CVE-2024-49814
IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecessary privileges...
CVE-2024-43187
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors...
CVE-2024-45657
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment...
CVE-2024-35138
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
PT-2025-6078
Name of the Vulnerable Software and Affected Versions Hickory DNS versions 0.8.0 through 0.24.2 Hickory DNS versions 0.25.0-alpha.1 through 0.25.0-alpha.4 Description The issue is related to insufficient authentication of data in the verify dnskey rrset function of the Hickory DNS client. This ca...
Security Bulletin: IBM Db2 and IBM WebSphere Application Server traditional used by IBM Security Verify Governance have multiple vulnerabilities
Summary IBM Security Verify Governance ISVG ships with IBM Db2 and IBM WebSphere Application Server traditional. Information about security vulnerabilities affecting these dependencies has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple security vulnerabilities were discovered in IBM Verify Identity Governance
Summary Multiple security vulnerabilities in IBM Java and IBM WebSphere Liberty have been addressed in the latest release of IBM Verify Identity Governance formerly known as IBM Security Verify Governance. Vulnerability Details CVEID:CVE-2024-27268 DESCRIPTION: IBM WebSphere Application Server...