Microsoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Microsoft Windows Active Directory Certificate Services. Authentication is required to exploit this vulnerability. The specific flaw exists within the issuance of certificates. By including...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-178 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Ubuntu 16.04 ESM : ca-certificates update (USN-6105-2)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-6105-2 advisory. USN-6105-1 updated ca-certificates. This provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the preceding...

PT-2023-17685 · Unknown · Loggregator-Agent +1

Name of the Vulnerable Software and Affected Versions: Cloud Foundry versions 1.140 through 1.152.0 loggregator-agent version 7 and later Description: The issue allows users to override other users' syslog drain credentials if they are aware of the client certificate used for that syslog drain...

FreeBSD : curl -- multiple vulnerabilities (a4f8bb03-f52f-11ed-9859-080027083a05)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a4f8bb03-f52f-11ed-9859-080027083a05 advisory. - The vulnerability exists due to a use-after-free error when checking the SSH sha256...

CURL-CVE-2023-28321 IDN wildcard match

curl supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN International Domain...

PT-2023-23857 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: The issue allows a remote attacker to create arbitrary files on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged...

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

CVE-2021-26406

Insufficient validation in parsing Owner's Certificate Authority OCA certificates in SEV AMD Secure Encrypted Virtualization and SEV-ES user application can lead to a host crash potentially resulting in denial of service...

CVE-2021-26406

Insufficient validation in parsing Owner's Certificate Authority OCA certificates in SEV AMD Secure Encrypted Virtualization and SEV-ES user application can lead to a host crash potentially resulting in denial of service...

CVE-2021-26406

Insufficient validation in parsing Owner's Certificate Authority OCA certificates in SEV AMD Secure Encrypted Virtualization and SEV-ES user application can lead to a host crash potentially resulting in denial of service...

Moderate: Red Hat Security Advisory: pki-core security, bug fix, and enhancement update

An update for jss, ldapjdk, pki-core, and tomcatjss is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

PT-2023-12100 · Amd · Amd Secure Encrypted Virtualization +1

Name of the Vulnerable Software and Affected Versions: AMD Secure Encrypted Virtualization SEV and SEV-ES affected versions not specified Description: The issue is related to insufficient validation in parsing Owner's Certificate Authority OCA certificates, which can lead to a host crash and...

AZL-37127 CVE-2023-31486 affecting package perl for versions less than 5.34.1-489

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates...

CVE-2023-31484

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS...

Design/Logic Flaw

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS...

CVE-2023-31485

GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...

CVE-2023-31484

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS...

CVE-2023-31486

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates...

CVE-2023-31486

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates...