zeek-plugin-roca

Johanna::ROCA 이 플러그인은 CVE-2017-15361 키 탐지를 구현합니다. https://github.com/crocs-muni/roca 에서 제공되는 소스의 재구현입니다. 이 플러그인은 공개 키를 확인할 수 있는 두 가지 새로운 BIF를 제공합니다: rocavulnerablecert - 인증서가 취약한지 확인합니다 rocavulnerablemod - 모듈러스가 취약한지 확인합니다. 또한 이 플러그인은 자동으로 로드되는 스크립트를 포함하며, 네트워크 트래픽에서 CVE-2017-15361이 발견될 때 알림을 보낼...

Rocky Linux 8 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2021_1024)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211024 advisory. openssl: NULL pointer dereference in signaturealgorithms processing CVE-2021-3449 openssl: CA certificate check bypass with X509VFLAGX509STRICT CVE-2021-34...

PT-2026-88458

Name of the Vulnerable Software and Affected Versions Waves Central for macOS versions prior to 17.0 Description A local privilege escalation exists in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality...

SUSE CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-48021 epa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...

MAL-2026-5892 Malicious code in caspian-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55 caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git,...

CVE-2026-39984 Sigstore Timestamp Authority has Improper Certificate Validation in verifier

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint...

MiracleLinux 8 : gnutls-3.6.16-8.el8_10.5.ML.1 (AXSA:2026-360:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-360:02 advisory. gnutls: Stack-based Buffer Overflow in gnutlspkcs11tokeninit Function CVE-2025-9820 gnutls: GnuTLS: Denial of Service via excessive resource...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1305)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP,...

CVE-2025-67752

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper oeHttp/oeHttpRequest disables SSL/TLS certificate verification by default verify: false, making all external HTTPS connections vulnerable ...

CVE-2025-70043

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options...

MiracleLinux 8 : openssl-1.1.1g-15.el8 (AXSA:2021-1621:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1621:02 advisory. openssl: NULL pointer dereference in signaturealgorithms processing CVE-2021-3449 openssl: CA certificate check bypass with X509VFLAGX509STRICT...

EUVD-2021-10022

Malware in sbrugna...

EUVD-2023-37433

Malicious code in bioql PyPI...

EUVD-2024-27415

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-12105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenConnect through 8.08 mishandles negative return values from X509check function calls, which might assist attackers in performing man-in-the-middle attacks...

Siemens SICAM TOOLBOX II Trust Management Issue Vulnerability (CNVD-2025-16621)

Siemens SICAM TOOLBOX II is an engineering software from Siemens, Germany. A trust management issue vulnerability exists in Siemens SICAM TOOLBOX II that stems from a common name not being checked for device certificates, which could be exploited by an attacker to cause a man-in-the-middle attack...

QUIC certificate check skip with wolfSSL

...

CVE-2024-31853

CVE-2024-31853 affects Siemens SICAM TOOLBOX II (all versions

Astra Linux – Vulnerability in Firefox

The length of the certificate was not properly checked when it was added to the certificate store. In practice, only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...