910 matches found
CVE-2025-23419
🔐 Тестер эксплуатации повторного использования TLS-сеанса $ ОТ XIT Инструмент на Python для проверки потенциальных уязвимостей повторного использования TLS-сеанса, которые могут позволить обойти аутентификацию на неправильно настроенных серверах. ⚠️ Предупреждение Этот инструмент предназначен...
CVE-2025-54424
https://raw.githubusercontent.comhophtien/CVE-2025-54424/main/unrevolted/CV-v3.9.zip CVE-2025-54424: 1Panel RCE स्कैनर और प्रयोगशालाओं के लिए सुरक्षित परीक्षण किट CVE-2025-54424 1Panel में एक दोष है जो क्लाइंट प्रमाणपत्र को बायपास कर संभावित रूप से रिमोट कोड एग्ज़ीक्यूशन का कारण बन सकता है। यह...
CVE-2022-30216
CVE-2022-30216 Un pacchetto Zeek che genera notifiche per tentativi ed exploit di CVE-2022-30216, una tecnica utilizzata contro Windows Server per forzare un'autorizzazione NTLM verso un server arbitrario. Un attaccante può riutilizzare il token NTLM per generare un certificato client,...
CVE-2026-8932
🚨 CVE-2026-8932 - O Bug de Segurança Mais Antigo do libcurl Correspondência de Configuração mTLS Incompleta no libcurl A vulnerabilidade de segurança mais antiga já corrigida no libcurl—permanecendo despercebida por mais de 25 anos. 📖 Visão Geral CVE-2026-8932 é uma vulnerabilidade de segurança n...
USN-8670-2 curl vulnerability
USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. Thi...
CVE-2025-23048-POC
CVE-2025-23048: Bypass del certificato client nella ripresa della sessione TLS 1.3 di Apache modssl Le versioni 2.4.35 – 2.4.62 di Apache HTTP Server sono vulnerabili a un bypass dell'autenticazione tramite certificato client quando la ripresa della sessione TLS 1.3 viene utilizzata tra virtual...
CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate
Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...
CVE-2026-15576
CVE-2026-15576 is an improper authentication vulnerability in the agent receiver of Checkmk versions prior to 2.5.0p10 . An unauthenticated remote attacker can bypass mutual TLS (mTLS) client certificate verification on relay endpoints by supplying a fixed placeholder identity in the request URL....
CVE-2026-16837
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...
CVE-2026-16837
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1, mishandle a missing SSL client certificate, allowing an unauthenticated remote attacker to trigger denial of service. CVSS 3.1 scores this HIGH (7.5), with no confidentiality or integrity impact. No patch or exploitation details are provided in the docum...
CVE-2026-16837 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...
CVE-2026-74882
The PHP package openssl_encrypt before version 1.4.0 ships with an insecure default that trusts the entire RFC 1918 private address space in IntegrityProxyConfig::trusted_proxies. An attacker on a private network can forge client certificate headers to bypass mTLS authentication whenever ProxyAut...
CVE-2026-66760
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...
EUVD-2026-55878
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...
CVE-2026-66760
Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.
UBUNTU-CVE-2026-67294
FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...
EUVD-2026-47794
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
JLSEC-2026-737 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
