CVE-2022-22156 Junos OS: Certificate validation is skipped when fetching system scripts from a HTTPS URL

An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle PitM attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity and confidentiality of the device. The...

Vulnerabilities fixed Juniper Junos OS

Juniper has fixed several vulnerabilities in Junos OS. The vulnerabilities allow a malicious party to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Spoofing Increased user privileges Because these are...

CVE-2021-37218

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4...

Improper Certificate Validation

nodejs is vulnerable to Improper handling of URI Subject Alternative Names. The vulnerability exists due to insufficient validation of URI Subject Alternative Names...

CVE-2022-22156

An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle PitM attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity and confidentiality of the device. The...

Juniper Networks Junos OS 信任管理问题漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. Juniper Networks Junos OS A trust management issue vulnerability exists in Juniper Networks Junos OS that...

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities

Summary The IBM Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These have been addressed in IBM Planning Analytics 2.0 - IBM Planning Analytics Workspace 2.0.72. Vulnerability Details CVEID: CVE-2021-21366 DESCRIPTION: Node.js xmldom modu...

Improper Certificate Validation in Apache IoTDB

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely...

GHSA-WC6F-CJCP-CC33 Improper Certificate Validation in Apache IoTDB

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

The vulnerability of the LibreOffice office software package, related to errors in the certificate validation process, allows a perpetrator to create ODF documents with a digital signature.

The vulnerability of the LibreOffice office software package is related to errors in the authentication process for certificates. Exploiting this vulnerability could allow a malicious actor to create ODF documents with digital signatures...

CVE-2021-44273

e2guardian v5.4.x = v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode i.e., acting as a proxy or a transparent proxy, with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers...

DEBIAN-CVE-2021-44273

e2guardian v5.4.x = v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode i.e., acting as a proxy or a transparent proxy, with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers...

UBUNTU-CVE-2021-44273

e2guardian v5.4.x = v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode i.e., acting as a proxy or a transparent proxy, with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers...

Design/Logic Flaw

e2guardian v5.4.x = v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode i.e., acting as a proxy or a transparent proxy, with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers...

e2guardian 信任管理问题漏洞

e2guardian is a web content filter that works in proxy, transparent or icap server mode. A trust management issue vulnerability exists in e2guardian that stems from e2guardian v5.4.x = v5.4.3r being affected by a lack of SSL certificate validation in the SSL MITM engine. In standalone mode i.e.,...

CVE-2021-44273

The CVE-2021-44273 issue affects e2guardian v5.4.x and earlier up to v5.4.3r. In standalone proxy mode with SSL MITM enabled, and when built against OpenSSL v1.1.x, the SSL MITM engine did not validate hostnames of upstream web servers, enabling potential MITM attacks. Public sources confirm the ...

PT-2021-24075 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: e2guardian versions 5.4.x through 5.4.3r Description: The issue is related to missing SSL certificate validation in the SSL MITM engine of e2guardian. Specifically, when e2guardian is used in standalone mode with SSL MITM enabled and is built...

Microsoft Azure Defender for IoT Improper Certificate Validation Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Azure Defender for IoT console and sensor appliances. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password reset mechanism. The issue...