8101 matches found
RLSA-2023:0089 Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...
RHEL 8 : libreoffice (RHSA-2023:0089)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0089 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...
Slackware Linux 15.0 / current mozilla-nss Vulnerability (SSA:2023-006-01)
The version of mozilla-nss installed on the remote host is prior to 3.87. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-006-01 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded D...
Amazon Linux 2 : python-pip (ALAS-2021-1667)
It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1667 advisory. The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given...
CVE-2022-45197
Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp...
Fedora 36 : python-slixmpp (2022-20a2dbdd45)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-20a2dbdd45 advisory. Security fix for CVE-2022-45197 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...
CVE-2022-42454 HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper certificate validation
Insights for Vulnerability Remediation IVR is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged network access...
CVE-2022-42454 HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper certificate validation
Insights for Vulnerability Remediation IVR is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged network access...
Mageia: Security Advisory (MGASA-2022-0469)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The vulnerabilities of the Pulsar C++ Client and Pulsar Python Client components of the cloud platform for distributed messaging and Apache Pulsar’s streaming communication allow attackers to execute “man-in-the-middle” attacks.
The vulnerability of the Pulsar C++ Client and Pulsar Python Client components of the cloud platform for distributed messaging and Apache Pulsar streaming communication is related to errors in the certificate validation process during TLS authentication. Exploiting this vulnerability could allow ...
Apache Bookkeeper vulnerable to Improper Certificate Validation
The Apache Bookkeeper Java Client before 4.14.6 and also 4.15.0 does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 a...
Zoom Client for Meetings < 5.3.0 Vulnerability (ZSB-21003)
The version of Zoom Client for Meetings installed on the remote host is prior to 5.3.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-21003 advisory. - The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate...
Improper Certificate Validation
github.com/traefik/traefik is vulnerable to improper certificate validation. A route secured using the mTLS connection is exposed to remote attackers due to improper client certificate verification when the TLSOption is empty...
Security update for python-slixmpp (moderate)
openSUSE Security Update: Security update for python-slixmpp Announcement ID: openSUSE-SU-2022:10242-1 Rating: moderate References: 1205433 Cross-References: CVE-2022-45197 Affected Products: openSUSE Backports SLE-15-SP4 An update that fixes one vulnerability is now available. Description: This...
OPENSUSE-SU-2022:10241-1 Security update for python-slixmpp
This update for python-slixmpp fixes the following issues: - CVE-2022-45197: Fixed certificate hostname validation boo1205433...
Amazon Linux 2022 : nss (ALAS2022-2022-223)
The version of nss installed on the remote host is prior to 3.83.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-223 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA...
Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Heimdal vulnerability (USN-5766-1)
The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5766-1 advisory. It was discovered that Heimdal did not properly manage memory when normalizing Unicode. An attacker could possibly use this issue to cause...
Improper Certificate Validation
nextcloud-desktop is vulnerable to improper certificate validation. The vulnerability exists due to man in the middle attacks in invalid TLS certificates which allows an attacker to take control of a machine between the client and the server...
The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt, related to errors in the certificate validation process, allows a perpetrator to carry out a “man-in-the-middle” attack.
The vulnerability of the configuration management system and the remote execution of operations in SaltStack Salt is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
