Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the CredentialdoValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

ROS-20220524-21

The cURL command-line utility vulnerability is related to a bug in the HSTS implementation that could allow curl to continue using the HTTP protocol instead of HTTPS if the hostname in the specified URL used an endpoint but did not use it when building the HSTS cache. Exploitation of the...

Security Bulletin: This Power System update is being released to address CVE-2020-1968

Summary POWER9: In response to a security issue with FSP's ASMi web GUI connection via OpenSSL a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2020-1968 Vulnerability Details CVEID:CVE-2020-1968 DESCRIPTION: OpenSSL could allow...

SUSE-SU-2022:1805-1 Security update for curl

This update for curl fixes the following issues: - CVE-2022-27781: Fixed CERTINFO never-ending busy-loop bsc1199223 - CVE-2022-27782: Fixed TLS and SSH connection too eager reuse bsc1199224...

The vulnerability of the gfix utility in the “Red Database” database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the gfix utility in the “Red Database” database management system is related to deficiencies in password masking during user login when the -f command is used as an argument passed to the utility. Exploiting this vulnerability can allow an attacker, operating remotely, to gai...

The vulnerability of the Apache Tomcat application server arises from errors that occur when both the WebSocket connection is terminated and WebSocket messages are sent at the same time. This allows an attacker to disclose sensitive information or carry out other malicious actions.

The vulnerability of the Apache Tomcat application server is related to errors that occur when both the WebSocket connection is closed and a WebSocket message is sent. Exploiting this vulnerability allows a malicious actor to disclose sensitive information or cause other adverse effects...

CVE-2018-18541

In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download...

CVE-2021-32642

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS RadSec RADIUS transports. Missing input validation in radsecproxy's naptr-eduroam.sh and radsec-dynsrv.sh scripts can lead to configuration injection via crafted radsec peer discovery DNS records. Users are subject to Informatio...

macOS 11.x < 11.6.6 Multiple Vulnerabilities (HT213256)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.6. It is, therefore, affected by multiple vulnerabilities: - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 - A logic issue...

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL allows a perpetrator to bypass the authentication process and gain unauthorized access to protected information.

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL relates to the repeated use of the same connection with the same credentials. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to protected...

CVE-2021-32934

Summary of CVE-2021-32934 : Affects ThroughTek P2P SDKs (versions ≤ 3.1.5, any nossl-tag builds) and certain firmware configurations (no AuthKey for IOTC, AVAPI without DTLS, P2PTunnel/RDT) where data between the local device and ThroughTek servers is not properly protected. This results in clear...

SUSE-SU-2022:1733-1 Security update for curl

This update for curl fixes the following issues: - CVE-2022-27781: Fixed CERTINFO never-ending busy-loop bsc1199223 - CVE-2022-27782: Fixed TLS and SSH connection too eager reuse bsc1199224...

OESA-2022-1659 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: This security flaw in curl allows to reuse an OAUTH2 authenticated connection without properly ensuring that the connection is authenticated wi...

Oracle Linux 8 : pki-core:10.6 (ELSA-2022-1851)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1851 advisory. - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM rhel-8 Tenable has extracted the preceding description block directl...

ISC BIND 9.18.0 < 9.18.3 Assertion Failure (cve-2022-1183)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2022-1183 advisory. - An assertion failure can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is...

SUSE SLED15: finch / finch-devel / libpurple / libpurple-branding-upstream / etc (SUSE-SU-2022:1693-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1693-1 advisory. - CVE-2022-26491: Fixed MITM vulnerability when DNSSEC wasn't used bsc1199025. Tenable has extracted the preceding...

GHSA-HW4G-FHCP-X5MQ Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or ...

GHSA-J6M4-FRXH-P4X8 Zope Object Database Denial of Service vulnerability

Race condition in ZEO/StorageServer.py in Zope Object Database ZODB before 3.10.0a2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an...

GHSA-9WCX-326R-7J7W Denial of Service in Apache ActiveMQ

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service file-descriptor exhaustion and broker crash or hang by sending many openwire failover:tcp:// connection requests...