BMC Control-M 安全漏洞

BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M that originates when an email address in a client certificate stops validating when it encounters a NULL byte, whi...

PT-2025-37943

Name of the Vulnerable Software and Affected Versions: Control-M/Agent versions 9.0.18 through 9.0.20 Control-M/Agent versions prior to 9.0.18 potentially earlier unsupported versions Description: The Access Control List ACL enforcement in Control-M/Agent can be bypassed when the C router is in...

Linux Distros Unpatched Vulnerability : CVE-2021-20335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the...

Linux Distros Unpatched Vulnerability : CVE-2018-16886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and...

Linux Distros Unpatched Vulnerability : CVE-2018-11783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't...

CVE-2025-7390

A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication...

CVE-2025-7390 Bypass the client certificate trust check of an opc.https server while only secure communication is allowed

A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication...

CVE-2025-7390

CVE-2025-7390 describes a bypass of the client certificate trust check in an opc.https server when the endpoint is configured to allow only secure communication. Connected sources indicate affected software/product context primarily around OPC.https servers (e.g., Softing edgeConnector) and Red H...

PT-2025-34191 · Unknown · Opc.Https Server

Name of the Vulnerable Software and Affected Versions: opc.https server affected versions not specified Description: A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication. Recommendations: ...

Exploit for Command Injection in Fit2Cloud 1Panel

https://github.com/hophtien/CVE-2025-54424/releaseshttps://gi...

CVE-2025-20215

A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisfied. Cisco has addressed this...

CVE-2025-20215 Cisco Webex Meeting Client Join Certificate Validation Vulnerability

A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisfied. Cisco has addressed this...

Cisco Webex Meeting Client Join Certificate Validation Vulnerability

A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisfied. Cisco has addressed this...

PT-2025-32189 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: A vulnerability in the meeting-join functionality of Cisco Webex Meetings could allow an unauthenticated, network-proximate attacker to complete a meeting-join process in place...

Cisco Webex Meetings 信任管理问题漏洞

Cisco Webex Meetings is a video conferencing solution from Cisco. A trust management issue vulnerability exists in Cisco Webex Meetings, which stems from a client-side certificate validation issue that could result in an unauthorized user joining a meeting...

BIT-VAULT-2025-6037 Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as +trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/certcertificate. In this configuration, an attacker may be able to...

CVE-2025-6037

A flaw was found in github.com/hashicorp/vault. The TLS certificate authentication method fails to properly validate client certificates when a non-CA certificate is designated as trusted. This vulnerability enables an attacker with a manipulated certificate to evade authentication and impersonat...

Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

Summary Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate . In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonat...

PT-2025-31663 · Hashicorp · Vault +1

Name of the Vulnerable Software and Affected Versions: Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1 Vault Enterprise versions prior to 1.19.7 Vault Enterprise versions prior to 1.18.12 Vault Enterprise versions prior to 1.16.23 Description: The TLS certificate auth...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2025-1775)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization head...