CVE-2024-6001

CVE-2024-6001 affects Lenovo software: Lenovo Accessories and Display Manager (LADM) and Lenovo Display Control Center (LDCC). The root cause is improper certificate validation that can let a network attacker redirect an update request to a remote server and execute code with elevated privileges....

CVE-2024-6001

An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a remote server and execute code with elevated privileges...

BIT-NODE-MIN-2021-44531

Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use...

Lenovo Display Control Center和Lenovo Accessories and Display Manager 安全漏洞

Lenovo Display Control Center LDCC and Lenovo Accessories and Display Manager LADM are both products of Lenovo, China.Lenovo Display Control Center is a software platform for Lenovo displays. Lenovo Accessories and Display Manager LADM are both products of Lenovo, China. Lenovo Display Control...

Security Bulletin: Loss of confidentiality in IBM WebSphere Application Server Liberty may affect IBM Storage Protect Operations Center (CVE-2023-50314).

Summary IBM Storage Protect Operations Center may be affected by loss of confidentiality caused by using a certificate issues by trusted authority in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2023-50314 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to a spoofing attack [CVE-2023-50314].

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to an attacker with access to the network to conduct spoofing attacks as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2024-2948)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is...

QNAP QTS Multiple Vulnerabilities (QSA-24-49)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

Amazon Linux 2022 : nss (ALAS2022-2021-002)

The version of nss installed on the remote host is prior to 3.71.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-002 advisory. NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS...

openSUSE 15 Security Update : icinga2 (openSUSE-SU-2024:0371-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0371-1 advisory. Update to 2.13.10: - CVE-2024-49369: Fix TLS certificate validation bypass bsc1233310. Tenable has extracted the preceding description block directly fro...

QNAP QuTS hero Multiple Vulnerabilities (QSA-24-49)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

PT-2024-10043 · Lenovo · Lenovo Accessories/Display Manager +1

Name of the Vulnerable Software and Affected Versions: Lenovo Accessories and Display Manager LADM affected versions not specified Lenovo Display Control Center LDCC affected versions not specified Description: The issue is related to improper certificate validation in the software, which could...

CVE-2024-12174

An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server...

CVE-2024-12174

An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server...

CVE-2024-12174

An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server...

CVE-2024-12174

CVE-2024-12174 affects Tenable Security Center and is caused by improper certificate validation when Security Center sends emails via an SMTP server. The underlying issue allows an authenticated, privileged attacker to intercept email messages sent from Security Center using a rogue SMTP server. ...

CVE-2024-54147

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks eg. public wifi, malicious DNS servers may have all GraphQL...

CVE-2024-54147 Altair GraphQL Client's desktop app does not validate HTTPS certificates

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks eg. public wifi, malicious DNS servers may have all GraphQL...

CVE-2024-54147 Altair GraphQL Client's desktop app does not validate HTTPS certificates

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks eg. public wifi, malicious DNS servers may have all GraphQL...

CVE-2024-54147

The CVE-2024-54147 entry covers Altair GraphQL Client (desktop) prior to version 8.0.5, where the application does not validate HTTPS certificates. This weakness enables a man-in-the-middle on untrusted networks to intercept GraphQL request/response headers and bodies (including authorization tok...