12357 matches found
CVE-2025-37731 Elasticsearch Improper Authentication
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...
CVE-2025-37731
CVE-2025-37731 affects Elasticsearch PKI realm authentication: impersonation possible via specially crafted client certificates signed by a trusted CA. Affected: Elasticsearch 7.0.x before 8.19.8, 9.0.x before 9.1.8, 9.2.x before 9.2.2. Root cause is improper authentication in the PKI realm. Impa...
CVE-2025-37731 Elasticsearch Improper Authentication
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...
Elasticsearch 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-27)
Elasticsearch Improper Authentication ESA-2025-27 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate...
Elasticsearch 安全漏洞
Elasticsearch is a search and analytics engine from Dutch company Elastic. A security vulnerability exists in Elasticsearch that stems from improper authentication and could lead to user impersonation via specially crafted client certificates...
PT-2025-51212
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw exists in the PKI realm authentication process within Elasticsearch. This issue allows a malicious actor to impersonate users by presenting a specially crafted client certificate...
Improper Certificate Validation
org.apache.gobblin, gobblin-core is vulnerable to Improper Certificate Validation. The vulnerability is due to the application trusting all certificates for LDAP connections in Gobblin-as-a-Service, which allows an attacker to perform man-in-the-middle attacks using malicious certificates...
SUSE-SU-2025:21193-1 Security update for go1.24
This update for go1.24 fixes the following issues: Update to go1.24.11. Security issues fixed: - CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames bsc1251257. - CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map bsc1251261. - CVE-2025-58185:...
CVE-2025-66506
A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service DoS due to excessive memory allocation when processing a malicious OpenID Connect OIDC identity token containing numerous period characters...
CVE-2025-61729
Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can...
CVE-2025-65290
Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files...
EUVD-2025-202334
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs...
December 9, 2025—KB5071507 (Security-only update)
None None...
November 11, 2025—KB5068779 (OS Build 25398.1965)
None None...
October 14, 2025—KB5066793 (OS Builds 22621.6060 and 22631.6060)
None None...
October 14, 2025—KB5066837 (OS Build 10240.21161)
None None...
December 9, 2025—KB5071543 (OS Build 14393.8688)
None None...
October 14, 2025—KB5066780 (OS Build 25398.1913)
None None...