4847 matches found
Code injection
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based x509 and RPK DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange...
CVE-2021-34433
The CVE concerns Eclipse Californium where certificate-based DTLS handshakes (X.509 and RPK) can accidentally succeed without verifying the client-side signature on the server, if the signature is not included in the server’s ServerKeyExchange. Affected versions are 2.0.0–2.6.4 and 3.0.0-M1–3.0.0...
CVE-2021-34433
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based x509 and RPK DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange...
CVE-2021-34433
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based x509 and RPK DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange...
CVE-2021-34433: Key Exchange without Entity Authentication
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based x509 and RPK DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange...
PT-2021-20528
Name of the Vulnerable Software and Affected Versions: Eclipse Californium versions 2.0.0 through 2.6.4 Eclipse Californium versions 3.0.0-M1 through 3.0.0-M3 Description: The certificate-based DTLS handshakes in Eclipse Californium may accidentally succeed without verifying the server side's...
Eclipse Californium 数据伪造问题漏洞
Eclipse Californium is a Java-based codebase from the Eclipse Foundation that provides Coap backend support for the Internet of Things. A data forgery vulnerability exists in Eclipse Californium, which arises when the product on the client side does not validate certificates from the server side...
Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11, v12 (CVE-2020-27221)
Summary Vulnerabilities in IBM® SDK Java™ Technology ,used by IBM Integration Bus & IBM App Connect Enterprise v11, v12. These issues were disclosed as part of the IBM Java SDK updates in January 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a...
Moderate: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.1.2 security update
An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...
PT-2021-7060
Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.6 through 2.0.11 Description The issue is related to the implementation of the MQTT v5 protocol in Eclipse Mosquitto, which can cause excessive CPU usage. This can be exploited by a remote attacker to cause a denia...
Security Bulletin: Potential vulnerability in Java
Summary A potential vulnerability has been identified related to Java. Refer to details for additional information. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from...
Security Bulletin: Multiple Vulnerabilities were detected in IBM Secure External Authentication Server
Summary There are multiple vulnerabilities in IBM Secure External Authentication Server. IBM Secure External Authentication Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-29725 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote user to consume resources...
Security Bulletin: CVE-2021-28165 In Eclipse Jetty CPU usage can reach 100% upon receiving a large invalid TLS frame.
Summary CVE-2021-28165 In Eclipse Jetty CPU usage can reach 100% upon receiving a large invalid TLS frame. Vulnerability Details CVEID: CVE-2021-28165 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by improper input valistion. By sending a specially-crafted TLS frame, a...
Security Bulletin: i2 Analyze has an information disclosure vulnerability (CVE-2019-17638)
Summary i2 Analyze uses a version of Jetty wth known vulnerabilities. Vulnerability Details CVEID: CVE-2019-17638 DESCRIPTION: Eclipse Jetty, as bundled in Jenkins, could allow a remote attacker to obtain sensitive information, caused by an issue with corrupt HTTP response buffer being sent to...
Eclipse Mosquitto Input Validation Error Vulnerability
Eclipse Mosquitto is a set of open source messaging agent software from the Eclipse Foundation.An input validation error vulnerability exists in Eclipse Mosquitto 2.07 and earlier versions, which allows an attacker to crash the server by sending a PUBLISH packet with subject length = 0...
CVE-2021-34432
In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0...
ALPINE-CVE-2021-34432
In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0...
DEBIAN-CVE-2021-34432
In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0...
