CVE-2018-2633

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

Heap overflow

In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer over-read in CheckCertSignatureex in wolfcrypt/src/asn.c...

CVE-2019-16748

CVE-2019-16748 affects wolfSSL (through 4.1.0) due to a missing sanity check of memory accesses during ASN.1 certificate parsing in the handshake. The issue is a one-byte heap-based buffer over-read in CheckCertSignature_ex (wolfcrypt/src/asn.c). This can lead to a severe impact as reflected by C...

CVE-2019-16748

In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer over-read in CheckCertSignatureex in wolfcrypt/src/asn.c...

CVE-2019-14915

An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate...

CVE-2019-14915

An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate...

Design/Logic Flaw

An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate...

CVE-2019-14915

PRiSE adAS 1.7.0 contains an XSS issue caused by unescaped certificate data submitted in rogue certificates. Affected component: certificate handling in PRiSE adAS 1.7.0. Root cause: improper escaping of certificate data. Exploitation details are not provided in the documents. No remediation or p...

CVE-2019-14915

An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate...

The vulnerability of the network software SKS Keyserver and the GNU Privacy Guard (GnuPG) software for encrypting information and generating digital signatures arises from the lack of verification of host data in the certificates. This allows attackers to trigger a service failure.

The vulnerability of the network software SKS Keyserver and the information encryption and digital signatures generation programs of GNU Privacy Guard GnuPG is related to the lack of verification of host data in the certificates. Exploiting this vulnerability could allow a malicious actor to caus...

Apache Traffic Server sslheader plugin information disclosure vulnerability

Apache Traffic Server is the United States Apache Software Foundation set of scalable HTTP proxy and caching server . Apache Traffic Server suffers from an information disclosure vulnerability that stems from the sslheaders plugin extracting information from client certificates and setting header...

PT-2019-2636 · Jenkins · Jenkins Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Plugin versions 2.1.18 and earlier Description: The issue allows users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path and obtain the...

DEBIAN-CVE-2018-11783

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 t...

PT-2019-12209 · Kubernetes +1 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.12.0 through 1.12.4 Kubernetes version 1.13.0 Description: The issue concerns the rest.AnonymousClientConfig method, which is supposed to return a copy of the provided config with credentials removed. However, in the...

Denial Of Service (DoS)

.NET Core is vulnerable to denial of service DoS. The vulnerability is possible because an unauthenticated user can parse malicious certificate data to trigger the attack...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...