The vulnerability of the Apache Tomcat application server arises from errors that occur when both the WebSocket connection is terminated and WebSocket messages are sent at the same time. This allows an attacker to disclose sensitive information or carry out other malicious actions.

The vulnerability of the Apache Tomcat application server is related to errors that occur when both the WebSocket connection is closed and a WebSocket message is sent. Exploiting this vulnerability allows a malicious actor to disclose sensitive information or cause other adverse effects...

CVE-2018-18541

In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download...

CVE-2021-32642

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS RadSec RADIUS transports. Missing input validation in radsecproxy's naptr-eduroam.sh and radsec-dynsrv.sh scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Informatio...

macOS 11.x < 11.6.6 Multiple Vulnerabilities (HT213256)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.6. It is, therefore, affected by multiple vulnerabilities: - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 - A logic issue...

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL allows a perpetrator to bypass the authentication process and gain unauthorized access to protected information.

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL relates to the repeated use of the same connection with the same credentials. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to protected...

CVE-2021-32934

Summary of CVE-2021-32934 : Affects ThroughTek P2P SDKs (versions ≤ 3.1.5, any nossl-tag builds) and certain firmware configurations (no AuthKey for IOTC, AVAPI without DTLS, P2PTunnel/RDT) where data between the local device and ThroughTek servers is not properly protected. This results in clear...

SUSE-SU-2022:1733-1 Security update for curl

This update for curl fixes the following issues: - CVE-2022-27781: Fixed CERTINFO never-ending busy-loop bsc1199223 - CVE-2022-27782: Fixed TLS and SSH connection too eager reuse bsc1199224...

OESA-2022-1659 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: This security flaw in curl allows to reuse an OAUTH2 authenticated connection without properly ensuring that the connection is authenticated wi...

Oracle Linux 8 : pki-core:10.6 (ELSA-2022-1851)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1851 advisory. - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 Tenable has extracted the preceding description block directl...

ISC BIND 9.18.0 < 9.18.3 Assertion Failure (cve-2022-1183)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2022-1183 advisory. - An assertion failure can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is...

SUSE SLED15: finch / finch-devel / libpurple / libpurple-branding-upstream / etc (SUSE-SU-2022:1693-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1693-1 advisory. - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used bsc1199025. Tenable has extracted the preceding...

GHSA-HW4G-FHCP-X5MQ Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

GHSA-J6M4-FRXH-P4X8 Zope Object Database Denial of Service vulnerability

Race condition in ZEO/StorageServer.py in Zope Object Database ZODB before 3.10.0a2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an...

GHSA-9WCX-326R-7J7W Denial of Service in Apache ActiveMQ

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service file-descriptor exhaustion and broker crash or hang by sending many openwire failover:tcp:// connection requests...

Denial of Service in Apache ActiveMQ

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service file-descriptor exhaustion and broker crash or hang by sending many openwire failover:tcp:// connection requests...

User confusion in IronJacamar

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

GHSA-PPG2-WW3W-HQ84 User confusion in IronJacamar

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

PyWBEM TOCTOU vulnerability in certificate validation

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate...

pki-core:10.6 security and bug fix update

jss 4.9.3-1 - Rebase to JSS 4.9.3 - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 4.9.2-1 - Rebase to JSS 4.9.2 ldapjdk 4.23.0-1 - Rebase to LDAP SDK 4.23.0 4.23.0-0.1 - Rebase to LDAP SDK 4.23.0-alpha1 pki-core 10.12.0-2.0.1 - Remove upstream...