CVE-2021-34599 Improper Certificate Validation in CODESYS Git

Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the serv...

CVE-2021-34599

CVE-2021-34599 affects CODESYS Git versions prior to 1.1.0.0, where HTTPS handshakes do not perform certificate validation by default. This transparent lack of server certificate verification can allow a man-in-the-middle attack on connections to untrusted TLS endpoints. The vulnerability is desc...

PT-2021-6475 · NetGear · Netgear R6400V2 +6

Name of the Vulnerable Software and Affected Versions: NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6400v2 affected versions not specified NETGEAR R6900P affected versions not specified NETGEAR R7000 affected versions not specified NETGEAR R7000P affected versions not specified NETGEAR RS40...

NSS -- Memory corruption

The Mozilla project reports: Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures Critical NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling...

Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures — Mozilla

NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS 7, or PKCS 12 are likely to be impacted. Applications using NSS...

CODESYS 信任管理问题漏洞

CODESYS is a controller development system from 3S-Smart Software Solutions, Germany. A trust management issue vulnerability exists in CODESYS Git, which stems from the lack of certificate validation in the HTTPS handshake in affected CODESYS Git versions prior to V1.1.0.0. An attacker could...

Vulnerabilities fixed in OpenBSD

Two vulnerabilities have been fixed in OpenBSD. The vulnerabilities apply to the kernel and libcrypto. The kernel vulnerability allows a local authorized user able to establish a denial of service on the system. This vulnerability is present in OpenBSD 6.9 and 7.0. The second vulnerability is in...

Security Bulletin: Vulnerability in Apache Log4j may affect Cúram Social Program Management (CVE-2020-9488)

Summary IBM Cúram Social Program Management uses the Apache Log4j libraries, for which there is a publicly known vulnerability. For this vulnerability, Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender...

Insecure Certificate Validation

aws-iot-device-sdk-v2 uses insecure certificate validation. Attackers are able to compromise certificate authorities in their trust stores on macOS, by spoofing DNS records to bypass CA pinning...

Insecure Certificate Validation

aws/aws-iot-device-sdk-js-v2 is vulnerable to Insecure Certificate Validation. Attackers are able to compromise certificate authorities in their trust stores on Linux/Unix, by spoofing DNS records to bypass CA pinning...

Insecure Certificate Validation

aws-iot-device-sdk-v2 uses insecure certificate validation. The library does not verify server certificate hostname during TLS handshake, allowing attackers to override certificate authorities in their trust stores on Microsoft Windows...

Insecure Certificate Validation

aws-iot-device-sdk-v2 uses insecure certificate validation. The library does not verify server certificate hostname during TLS handshake, allowing attackers to override certificate authorities in their trust stores on MacOS...

Improper Certificate Validation

Connections initialized by the AWS IoT Device SDK v2 for Java, Python , C++ and Node.js does not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in their trust stores on Windows. This issue has been addressed in aws-c-io submodule onward. This...

Improper Certificate Validation

Connections initialized by the AWS IoT Device SDK v2 for Java, Python , C++ and Node.js does not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule onward. This issu...

Improper Certificate Validation

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

Ubuntu 20.04 LTS : LibreOffice vulnerabilities (USN-5153-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5153-1 advisory. It was discovered that LibreOffice incorrectly handled digital signatures. An attacker could possibly use this issue to create a specially crafted docume...

Gallagher Command Centre Server incorrect certificate validation vulnerability

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings.Gallagher Command Centre Server has a security vulnerability that stems from incorrect certificate validation in the SMTP client, which could be exploited by an...

GHSA-MJWW-934M-H4JW Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core

A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates...

Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core

A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates...

[SECURITY] [DSA 5011-1] salt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5011-1 [email protected] https://www.debian.org/security/ Markus Koschany November 19, 2021 https://www.debian.org/security/faq -...