762 matches found
RHEL 5 : freeradius (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - freeradius: Out-of-bounds write in radcoalesce CVE-2017-10979 - modules/rlmunix/rlmunix.c in FreeRADIUS...
Netentsec NS-ASG Application Security Gateway SQL注入漏洞
Netentsec NS-ASG Application Security Gateway is an application security gateway from China Netentsec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from an SQL injection vulnerability in the parameter CRLId in the file...
CVE-2024-23979
When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point CRLDP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support EoTS are n...
Authentication flaw
When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point CRLDP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support EoTS are n...
CVE-2024-23979
BIG-IP CVE-2024-23979 affects SSL Client Certificate LDAP and CRLDP Authentication profiles when configured on a virtual server, causing undisclosed requests to increase CPU resource utilization and potentially degrade performance (DoS) per the F5 security advisory K000134516. The issue is docume...
F5 BIG-IP Security Vulnerabilities
F5 BIG-IP is an application delivery platform from F5 Corporation that integrates network traffic management, application security management, load balancing, and other features. A security vulnerability exists in F5 BIG-IP that stems from an undisclosed request that may result in increased CPU...
The vulnerability lies in the implementation of the TLS protocol in the cURL command-line utility. This allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the TLS protocol’s command-line utility cURL stems from an erroneous preservation of the session identifier due to lack of verification of certificate revocation. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain unauthorized...
Internet Bug Bounty: CVE-2024-0853: OCSP verification bypass with TLS session reuse
CVE-2024-0853 was a vulnerability in the cURL library where OCSP verification was bypassed when reusing a TLS session. The vulnerability was caused by cURL inadvertently keeping the SSL session ID in its cache even when the OCSP stapling verification failed. This allowed subsequent transfers to t...
CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project
The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container registry can provide outdated versions o...
curl: CVE-2024-0853: OCSP verification bypass with TLS session reuse
A vulnerability was identified in cURL version 8.5.0 that allowed revoked certificates to be accepted when reusing a TLS session. The issue was caused by a correction that inadvertently skipped OCSP stapling verification during TLS session reuse. This allowed revoked certificates to be accepted i...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. An attacker with access to the private key of a correctly issued certificate and the ability...
CVE-2023-51662 Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not...
snowflake-connector-net Trust Management Issues Vulnerability
Snowflake snowflake-connector-net is a Snowflake connector for . A trust management issue vulnerability exists in snowflake-connector-net versions 2.0.25 through 2.1.4 due to a failure to perform a check against the Certificate Revocation List CRL...
CLSA-2023-1701446356 libksba: Fix of 2 CVEs
CVE-2022-3515: detect a possible overflow directly in the TLV parser - CVE-2022-47629: fix an integer overflow in the CRL signature parser...
SUSE CVE-2021-20179
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity...
SUSE CVE-2023-5255
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked...
CVE-2023-5255
An improper resource release vulnerability was found in puppet. For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked...
CVE-2023-5255
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked...
