curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols

A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...

PUB-A-194697257

In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Oracle Linux 7 : thunderbird (ELSA-2021-3841)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-3841 advisory. 91.2.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 91.2.0-1 - Update to 91.2.0 build1 91.1.2-1 - Upda...

Downgrade Attack

thunderbird is vulnerable to downgrade attack. Remote attacker is able to take control of the authenticated session and execute SMTP commands resulting in a man in the middle attack...

CentOS 8 : thunderbird (CESA-2021:3838)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3838 advisory. - rust-crossbeam-deque: race condition may lead to double free CVE-2021-32810 - Mozilla: Use-after-free in MessageTask CVE-2021-38496 - Mozilla:...

Oracle Linux 8 : thunderbird (ELSA-2021-3838)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-3838 advisory. 91.2.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 91.2.0-1 - Update to 91.2.0 build1 91.1.2-1 - Upda...

RHEL 8 : thunderbird (RHSA-2021:3838)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3838 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.2.0. Security Fixes: Mozilla:...

RHEL 7 : thunderbird (RHSA-2021:3841)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3841 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.2.0. Security Fixes: Mozilla:...

RHEL 8 : thunderbird (RHSA-2021:3840)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3840 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.2.0. Security Fixes: Mozilla:...

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix security vulnerabilities: Due to a data race in the crossbeam-deque in the crossbeam crate, one or more tasks in the worker queue could have been be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this...

Mozilla: Downgrade attack on SMTP STARTTLS connections

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.2.0. Security Fixes: Mozilla: Use-after-free in MessageTask CVE-2021-38496 Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 CVE-2021-38500 Mozilla:...

Mozilla Thunderbird < 91.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-47 advisory. - Mozilla developers and community members Kevin Brosnan, Mihai Alexandru Michis, and Christian Holler...

OpenSSL: Ciphersuite Downgrade Attack (20101202) - Windows

OpenSSL is prone to a ciphersuite downgrade attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

...

CVE-2020-27208

The CVE-2020-27208 issue affects SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token, where the flash read-out protection (RDP) level is not enforced during device initialization, enabling an attacker with physical access to downgrade RDP and read secrets (e.g., private ECC keys) from SRAM vi...

EulerOS 2.0 SP3 : perl-DBD-MySQL (EulerOS-SA-2021-1828)

According to the versions of the perl-DBD-MySQL package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of...

EulerOS Virtualization 3.0.2.6 : perl-DBD-MySQL (EulerOS-SA-2021-1447)

According to the versions of the perl-DBD-MySQL package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of...

CVE-2021-21472

SAP Software Provisioning Manager 1.0 SAP NetWeaver Master Data Management Server 7.1 does not have an option to set password during its installation, this allows an authenticated attacker to perform various security attacks like Directory Traversal, Password Brute force Attack, SMB Relay attack,...

Security Bulletin:Vulnerability in Diffie-Hellman ciphers affects Rational Synergy (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects Rational Synergy Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey ...