EulerOS 2.0 SP10 : openssl (EulerOS-SA-2023-1825)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2023-1807)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that...

The vulnerability of the Ruby interpreter’s Time library allows a hacker to cause a service failure.

The vulnerability of the Ruby interpreter’s Time library relates to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SUSE SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2023:1704-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1704-1 advisory. - A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains...

SUSE SLES15: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2023:1703-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1703-1 advisory. Security fixes: - CVE-2023-0464: Fixed excessive Resource Usage Verifying X.509 Policy Constraints bsc1209624. Other fixes: -...

FreeBSD : OpenSSL -- Excessive Resource Usage Verifying X.509 Policy Constraints (1ba034fb-ca38-11ed-b242-d4c9ef517024)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1ba034fb-ca38-11ed-b242-d4c9ef517024 advisory. - A security vulnerability has been identified in all supported versions of OpenSSL related to the...

Design/Logic Flaw

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

CVE-2023-0464

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

CVE-2023-0464

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

OpenSSL 3.0.0 < 3.0.9 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.9. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.9 advisory. - The function X509VERIFYPARAMadd0policy is documented to implicitly enable the certificate policy check when doing certificate...

OpenSSL 1.0.2 < 1.0.2zh Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2zh. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zh advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact...

OpenSSL 1.1.1 < 1.1.1u Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1u. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1u advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2022-26115

Fortinet FortiSandbox is affected by CVE-2022-26115 due to a use of a password hash with insufficient computational effort (CWE-916) prior to version 4.2.0. An attacker with access to the password database could mount bulk guessing attacks to recover passwords. Connected sources confirm the issue...

Improper password storage mechanism

...

CVE-2022-40258: Use of Password Hash With Insufficient Computational Effort

AMI Megarac Weak password hashes for Redfish & API...

Siemens Desigo PXC and DXR Devices Use of Password Hash with Insufficient Computational Effort (CVE-2022-24041)

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...

Vulnerability of SNC_io parser <EW>: read_sedge(); seh->incident_sface(); component Nef_S2/SNC_io parser.h; library of computational geometry algorithms CGAL. This allows an intruder to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the SNCio parser function ::readsedge in the NefS2/SNCio parser component, located in the NefS2/SNCio parser.h file, and the associated CGAL computational geometry algorithm libraries, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker ...

Vulnerability of SNC_io parser<EW>::read_volume() seh->twin() component Nef_S2/SNC_io parser.h library of computational geometry algorithms CGAL, allowing an intruder to access confidential data, compromise its integrity, and cause service failure.

The vulnerability of the SNCioparser function: readvolume, seh-twin in the NefS2/SNCioparser.h component, and the algorithms from the Computational Geometry Library CGAL are related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data...