Lucene search
+L

1418 matches found

Github Security Blog
Github Security Blog
added 2023/06/30 8:21 p.m.34 views

atty potential unaligned read

On windows, atty dereferences a potentially unaligned pointer. In practice however, the pointer won't be unaligned unless a custom global allocator is used. In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment. atty is Unmaintained A Pull Reques...

7.1AI score
SaveExploits0References4Affected Software1
RedHat Linux
RedHat Linux
added 2023/06/29 8:7 p.m.9 views

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

5.8CVSS7.4AI score0.09254EPSS
SaveExploits0References4
Japan Vulnerability Notes
Japan Vulnerability Notes
added 2023/06/27 12:0 a.m.62 views

JVN#38343415: Multiple vulnerabilities in Aterm series

Aterm series provided by NEC Corporation contain multiple vulnerabilities listed below. Directory traversal CWE-22 - CVE-2023-3330 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N| Base Score: 2.6 CVSS v2| AV:A/AC:M/Au:S/C:P/I:N/A:N| Base Score: 2.3...

7.2CVSS6.2AI score0.00713EPSS
SaveExploits0
HackRead
HackRead
added 2023/06/19 10:17 p.m.9 views

Data Breach at New BreachForums: 4,000 members’ data leaked

By Waqas BreachForums is a recently resurfaced alternative to the popular hacker and cybercrime forum, Breach Forums, which is now defunct. This is a post from HackRead.com Read the original post: Data Breach at New BreachForums: 4,000 members’ data leaked...

7AI score
SaveExploits0
HackRead
HackRead
added 2023/06/19 6:56 p.m.31 views

Data Breach at New BreachForums: 4,000 members’ data leaked

By Waqas BreachForums is a recently resurfaced alternative to the popular hacker and cybercrime forum, Breach Forums, which is now defunct. This is a post from HackRead.com Read the original post: Data Breach at New BreachForums: 4,000 members data leaked...

7AI score
SaveExploits0
Veracode
Veracode
added 2023/06/06 4:56 p.m.41 views

Improper Certificate Validation

curl is vulnerable to Improper Certificate Validation. The vulnerability allows matching of wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates and could result in accepting patterns that otherwise should be mismatched...

5.9CVSS6.8AI score0.0181EPSS
SaveExploits1References19Affected Software2
RustSec
RustSec
added 2023/06/01 12:0 p.m.19 views

`users` crate is unmaintained

The users crate hasn't seen any action since 2020-10-08. The developer seems MIA since. Recommended alternatives - uzers - sysinfo MIA: https://github.com/ogham/rust-users/issues/54 uzers: https://crates.io/crates/uzers sysinfo: https://crates.io/crates/sysinfo...

7.2AI score
SaveExploits0
NVD
NVD
added 2023/05/30 4:15 a.m.41 views

CVE-2023-32698

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

7.1CVSS7.1AI score0.00384EPSS
SaveExploits1References3
CVE
CVE
added 2023/05/30 3:56 a.m.311 views

CVE-2023-32698

CVE-2023-32698 affects the nfpm tool (GoReleaser nfpm) where, if files are packaged without enforcing nfpm’s own permissions, checked‑in files could be created with dangerous permissions (e.g., 666 or 777). The root cause is incorrect/default file permission handling during packaging, leading to ...

7.1CVSS6.8AI score0.00384EPSS
SaveExploits1References3Affected Software1
OSV
OSV
added 2023/05/30 3:56 a.m.24 views

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

7.1CVSS6.9AI score0.00384EPSS
SaveExploits1References5
Microsoft CVE
Microsoft CVE
added 2023/05/27 7:0 a.m.6 views

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match but the wildcard check in curl could still check for `x*` which would match even though the IDN name most likely contained nothing even resembling an `x`.

...

5.9CVSS6.6AI score0.0181EPSS
SaveExploits1
OSV
OSV
added 2023/05/26 9:15 p.m.7 views

AZL-26812 CVE-2023-28321 affecting package rust for versions less than 1.72.0-2

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.9CVSS6.7AI score0.0181EPSS
SaveExploits1References1
OSV
OSV
added 2023/05/26 9:15 p.m.8 views

AZL-26794 CVE-2023-28321 affecting package curl for versions less than 8.2.1-1

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.9CVSS6.7AI score0.0181EPSS
SaveExploits1References1
OSV
OSV
added 2023/05/26 9:15 p.m.5 views

ALPINE-CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.9CVSS7AI score0.0181EPSS
SaveExploits1References1
NVD
NVD
added 2023/05/26 9:15 p.m.28 views

CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.9CVSS6.7AI score0.0181EPSS
SaveExploits1References12
Vulnrichment
Vulnrichment
added 2023/05/26 12:0 a.m.7 views

CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.8AI score0.0181EPSS
SaveExploits1References12
Cvelist
Cvelist
added 2023/05/26 12:0 a.m.44 views

CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

6.3AI score0.0181EPSS
SaveExploits1References12
SUSE CVE
SUSE CVE
added 2023/05/18 2:19 a.m.7 views

SUSE CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

4.3CVSS8.8AI score0.0181EPSS
SaveExploits1References98
OSV
OSV
added 2023/05/17 6:0 a.m.6 views

UBUNTU-CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

5.9CVSS6.7AI score0.0181EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2023/05/16 10:16 a.m.7 views

curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

5.9CVSS6.8AI score0.01607EPSS
SaveExploits1References5
Rows per page
Query Builder