7938 matches found
PT-2020-17897
Name of the Vulnerable Software and Affected Versions IBM Security Guardium Insights version 2.0.1 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM Security...
PT-2020-17892
Name of the Vulnerable Software and Affected Versions IBM Security Guardium Insights version 2.0.1 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM Security...
CVE-2020-12619
MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.5.6 security update
An update for jenkins-2-plugins and python-rsa is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
python-rsa: decryption of ciphertext leads to DoS
A flaw was found in the python-rsa package, where it does not explicitly check the ciphertext length against the key size and ignores the leading 0 bytes during the decryption of the ciphertext. This flaw allows an attacker to perform a ciphertext attack, leading to a denial of service. The highe...
RHEL 7 : OpenShift Container Platform 4.5.6 (RHSA-2020:3453)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3453 advisory. The Matrix Project is a module which handles creating Jenkins multi-configuration projects matrix projects. Matrix Authorization allows...
Insecure Storage of Sensitive Information in smirzaei/rails-session-decoder
Overview rails-session-decoder is a simple utility for decoding Rails 4.x sessions in Node.js, this package are vulnerable to Information Exposure. Missing verification of the Message Authentication Code appended to the cookies may lead to decryption of cipher text, exposing encrypted information...
CVE-2020-2035
When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...
Design/Logic Flaw
When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...
CVE-2020-2035 PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions
When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...
CVE-2020-2035
CVE-2020-2035 (PAN-OS) affects PAN-OS when SSL/TLS Forward Proxy Decryption is enabled. The URL filtering policy inspects HTTP Host/URL path but ignores the TLS Client Hello SNI, allowing a compromised host to evade policies on decrypted HTTPS traffic. Impact is described as low for integrity; no...
PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions
When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...
PT-2020-15260
Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 10.1 Description The PAN-OS URL filtering feature does not consider the Server Name Indication SNI field within the TLS Client Hello handshake when SSL/TLS Forward Proxy Decryption mode is enabled. This allows a...
CVE-2020-8911
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
Authentication flaw
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
CVE-2020-8912: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
PT-2020-20365
Name of the Vulnerable Software and Affected Versions AWS S3 Crypto SDK for GoLang versions prior to V2 Description A vulnerability exists in the in-band key negotiation of the AWS S3 Crypto SDK for GoLang. An attacker with write access to the targeted bucket can change the encryption algorithm o...
TLS Version 1.1 Protocol Detection (PCI DSS)
The remote service accepts connections encrypted using TLS 1.1. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients. C Tenable Network...
PT-2020-6739
Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions APQ8053 through SM7150 Qualcomm Snapdragon Compute versions APQ8053 through SM7150 Qualcomm Snapdragon Connectivity versions APQ8053 through SM7150 Qualcomm Snapdragon Consumer IOT versions APQ8053 through...
