CVE-2023-27535

An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain...

CVE-2023-27535

An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain...

CVE-2023-27538

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequen...

CVE-2023-27536

CVE-2023-27536 affects libcurl

CVE-2023-27535

An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain...

SUSE CVE-2023-28858

redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4....

CVE-2023-0922

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection...

[CGS] Citrix Cloud Workspace launching Desktop via CSG is stuck at "connecting" and failed

Citrix Cloud Workspace launching Desktop/App via CSG Citrix Gateway Service is stuck at "connecting" and failed. In the Netscaler Gateway Service logs, seen in ns.log: Event "Application launch failed. Connect command sent to Controller."...

WAGO 750 Series Improper Resource Shutdown or Release (CVE-2018-8836)

Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port...

CVE-2023-0775

An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service...

Race Condition

redis is vulnerable to a Race Condition. The vulnerability exists because the library leaves the connection open after cancelling an async Redis command at a critical time such as the case of a pipeline operation resulting in a client receiving data from an related request. Note: this issue exist...

Race Condition

redis-py is vulnerable to a Race Condition. The vulnerability exists because the library leaves a connection open after cancelling the async Redis command at an inopportune time in the case of a pipeline operation and can send response data to the client of an unrelated request in an off-by-one...

Rocky Linux 8 : openssl (RLSA-2023:1405)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:1405 advisory. - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a...

Fedora 38 : curl (2023-0de03a9232)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0de03a9232 advisory. - fix SSH connection too eager reuse still CVE-2023-27538 - fix HSTS double-free CVE-2023-27537 - fix GSS delegation too eager connection re-use...

CVE-2023-25263

In Stimulsoft Designer Desktop 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating...

NATS TLS certificate common name validation bypass

The NATS official Rust clients are vulnerable to MitM when using TLS. A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats = 0.29 which already fixed this vulnerability. The common name of the server's TLS...

Cross site scripting

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible...

CVE-2022-48426

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible...

CVE-2022-48426

CVE-2022-48426 affects JetBrains TeamCity versions prior to 2022.10.3. The vulnerability is a stored XSS in Perforce connection settings , as confirmed by multiple sources (NVD entry and security analyses). Impact is limited to XSS exposure via Perforce settings; exploitation status is not detail...

USN-5964-2 curl vulnerabilities

USN-5964-1 fixed several vulnerabilities in curl. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Harry Sintonen discovered that curl incorrectly handled certain TELNET connection options. Due to lack of proper input scrubbing,...